This project is a Node.js CLI tool to identify which of a project's existing dependencies are utilising npm lifecycle scripts, which could be malicious.

The currently configured npm scripts the tool will identify are: preinstall, postintall, preuninstall, postuninstall

Note: This project is to educate, so should not be used as a complete npm security solution.

# install globally, using npm $ npm install npm-viewscripts -g # Run the cli on a project $ cd my-node-project $ npm install $ npm-viewscripts 

$ npm-viewscripts Usage $ npm-viewscripts [path] Options path Modules folder [Default: node_modules] 

Positive report example:

Potentially unsafe scripts found. These should be reviewed for safety Module name: monorepo-symlink-test Type: postinstall 

The above output informs us that the monorepo-symlink-test is running a postinstall script, so we should review that, and ensure that it is safe.

Negative report example:

No potentially unsafe scripts found. 

No modules in the project are currently using scripts which could be used maliciously.