NPMscan / npmscan-action
git clone https://github.com/NPMscan/npmscan-action.git
v1.4.0 · 18d ago
GitHub Action that scans npm dependency changes in pull requests for vulnerabilities, malware, and risky install scripts or lockfile changes.
Why you might care
Checks package.json and lockfile changes on each PR for known vulnerabilities and malware via OSV.dev and GitHub Advisories, plus new install scripts and repointed lockfile tarballs that CVE scanners miss. Posts one PR comment and can fail the check on thresholds; no API key or account needed, and it works on private repos.
+0
stars, 24h · #67,715
+-9
stars, 7 days · #76,778
+~726
stars, 30 days · #1,530
509
★ total · -2% this week
0
forks · 2 open issues
Star history (as recorded here)
LanguageTypeScript
LicenseMIT
Created2026-10-02 (1mo ago)
Last pushtoday
Watchers0
OwnerOrganization
GitHub topics
Links
- GitHub: github.com/NPMscan/npmscan-action
- Homepage: https://npmscan.com/
- Releases · Issues · Hacker News mentions
README
Loading README…
Blurb generated by claude-haiku-5-5 13d ago. Star deltas marked ~ are extrapolated from partial history.