Image: NPMscan
Why it mattersA reviewer stops staring at a 500-line lockfile diff. The action marks each risky line and fails the check when it is bad enough to block.
Any team that has pulled an npm update knows the review tax. The lockfile diff is 500 lines long. The reviewer glances at it and clicks approve. A tiny line somewhere in there is the postinstall script that steals the token. NPMscan Action is a free GitHub Action that reads the same diff on every pull request. It flags the lines a human will miss. The repository has 432 stars three weeks after it was created. The licence is MIT.
The action is published by BlockHacks.io and powered by the npmscan.com service. It is written in TypeScript.
What it checks
The action looks only at pull requests that touch package.json or lockfiles. For each change it checks four things.
The first is known malware and known vulnerabilities. The README says these come "from OSV.dev and GitHub Advisories". Those are the public databases maintained by Google and GitHub. The second is a new install script. A dependency that suddenly runs code on npm install is a common pattern in hijacked packages. The third is a repointed lockfile entry. That is a line where the same version number downloads a different tarball, or downloads from an unknown server. The fourth is a change to the root install scripts and overrides, including preinstall, postinstall and prepare.
How it reports
The README describes the output in plain terms. It "posts one PR comment, marks each finding on its line in Files changed". It also "fails the check when something meets your thresholds". The threshold is a fail-on-severity setting. It takes low, moderate, high, critical or none. "Known malware blocks regardless" of the setting.
The action also emits three numbers for other steps to read: flagged-count is total findings, blocking-count is findings that fail the check, and error-count is unscanned files. A warn-only mode leaves the check green and still posts the comment.
What it does not do
The README is clear on what the tool is not. It is not a CVE-based scanner. It reports no scores from a CVE database, and it does not try to patch anything. It does not store anything either. "Only the dependency file being scanned is sent over HTTPS" and "Nothing stored. The files are used to compute the diff and then discarded."
The action handles fork pull requests on read-only tokens, Dependabot pull requests and monorepos with more than one lockfile.
Where it fits
A team that already runs npm audit in CI gets a check that works on a different axis. npm audit reads what has been published about packages. NPMscan reads what has just changed about them in this pull request. A reviewer who sees a comment pointing at line 1,423 in a lockfile has a cheaper decision. A reviewer who must read the whole file does not.
Source
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
