Skip to content
#

npm-security

Star

Here are 29 public repositories matching this topic...

Language: All
Filter by language
All 29 TypeScript 10 JavaScript 7 Python 3 Rust 3 Shell 3 PowerShell 1
Sort: Most stars
Sort options
Most stars Fewest stars Most forks Fewest forks Recently updated Least recently updated

agentic-dev3o / sandbox-shell

Star 19

macOS Seatbelt sandbox CLI for developers. Protect credentials (SSH, AWS, GPG) from malicious npm packages, supply chain attacks, and untrusted build scripts. Deny-by-default filesystem isolation. Perfect for Claude Code agentic workflows with --dangerously-skip-permissions.

macos shell rust cli security terminal sandbox developer-tools seatbelt supply-chain-security sandbox-exec credential-protection agentic-ai claude-code npm-security
  • Updated Apr 27, 2026
  • Rust

triconinfotech / shai-hulud-malicious-packages

Star 8

Autonomous “Shai-Hulud” engine that ingests malicious NPM package advisories from OSV, tracks versions and metadata, and maintains a continuously updated threat intelligence database.

nodejs npm security automation infosec osv security-tools devsecops threat-intelligence malware-detection github-actions open-source-security supply-chain-security package-security npm-security shai-hulud shai-hulud-detector shai-hulud2-detector malicious-packages-db
  • Updated Apr 28, 2026
  • JavaScript

dream-horizon-org / sentinel

Star 4

Sentinel Package Manager blocks compromised packages BEFORE installation, preventing malicious code execution. Features: Pre-install blocking, command interception (npm/yarn/pnpm/bun), 795+ blacklist (Shai-Hulud), real-time checks (OSV/GitHub/Snyk), zero dependencies, auto-updates. Counters supply chain attacks.

npm security package-manager blacklist yarn pnpm security-tools bun vulnerability-scanner malware-detection zero-dependencies dependency-security supply-chain-security npm-security shai-hulud supply-chain-attack pre-install-validation package-validation npm-worm compromised-packages
  • Updated Dec 2, 2025
  • JavaScript

josedacosta / shai-hulud-detector

Star 2

🛡️ Advanced NPM supply chain attack detection tool - Specialized in detecting Shai-Hulud compromise indicators with beautiful CLI interface and automated security reporting

threat-hunting vulnerability-detection security-analysis malware-detection defensive-security npm-audit malicious-packages compromise-detection crypto-stealer npm-security shai-hulud shai-hulud-detector shai-hulud-attack supply-chain-attack self-replicating-worm github-actions-malware bundle-js-detection trufflehog-abuse cli-security-tool package-scanner
  • Updated Sep 19, 2025
  • TypeScript

BuildWithAbid / mcp-shield

Star 1

Security scanner for MCP (Model Context Protocol) servers. Detect prompt injection, secrets leaks, supply chain attacks, and vulnerabilities in MCP servers. CLI + MCP server mode.

security-audit typescript mcp static-analysis cybersecurity security-scanner claude cli-tool vulnerability-scanner ai-security secrets-detection supply-chain-security ai-agent prompt-injection llm-security model-context-protocol mcp-server mcp-tools mcp-security npm-security
  • Updated Apr 23, 2026
  • TypeScript

copyleftdev / lazarus-19day-abtest

Star 0

Threat intel package for Lazarus Group's 3-wave GitHub phishing campaign targeting developers (Mar-Apr 2026). YARA, Sigma, Suricata, Nuclei rules + STIX 2.1 bundle + ATT&CK Navigator layer + full C2 infrastructure map. Defensive use only.

ioc apt phishing suricata nuclei stix sigma yara dprk threat-intelligence detection-rules mitre-attack supply-chain-security developer-security npm-security lazarus-group contagious-interview
  • Updated Apr 9, 2026
  • Python

Improve this page

Add a description, image, and links to the npm-security topic page so that developers can more easily learn about it.

Curate this topic

Add this topic to your repo

To associate your repository with the npm-security topic, visit your repo's landing page and select "manage topics."

Learn more