Case study
safe-npm-install
An open-source CLI that evaluates npm supply chain risk before a package is installed.
Overview
safe-npm-install is a developer security utility for inspecting npm package risk before installation. It looks at practical supply chain signals and returns an understandable risk score, helping developers choose more stable package versions and apply checks in local workflows or CI/CD pipelines.
Technical details
- 01
Detects preinstall and postinstall scripts
- 02
Checks release freshness, package age, download volume, maintainer trust, and dependency size
- 03
Calculates a risk score from 0 to 100
- 04
Recommends stable or safer package versions
- 05
Supports strict mode and JSON output for CI/CD integration
Impact
Makes npm package review faster and more consistent by surfacing practical supply chain signals before dependencies enter a project.
- Developer security
- CI/CD checks
- Open-source package evaluation