NPM Postinstall Attack Scanner
Detect npm supply chain attacks that use the postinstall + hidden dependency pattern to deliver malware. Built in response to the axios maintainer account takeover (2026-03-31). Scans lockfiles, odemodules, postinstall scripts, version ranges, and npm cache across 5 phases. Returns actionable remediation steps when issues are found.
Works with: Claude Code, Cursor, Claude Desktop, Codex CLI, Gemini CLI, Cline, Windsurf, VS Code
Category: Security — see all ranked ›
- tashan score: 34.0
- Adoption: 1 repos
- Health: active
- GitHub stars: 1
- Contributors: 1
- License: MIT
Security audit
Not scanned yet. We audit npm-published capabilities for known advisories, install-time scripts and permission surface; this one has no npm package we can resolve, or has not reached the queue.
source ↗ · plugin:aliksir/npm-postinstall-attack-scanner/npm-postinstall-attack-scanner
Already running this? npx tashan-cli doctor checks your whole config against the Index — how it works ›