@dpdp-india/audit
v0.2.0
Published
CLI tool to scan JS/TS projects for DPDP (Digital Personal Data Protection) compliance violations
Maintainers
ankitbabbarReadme
@dpdp-india/audit
CLI tool to scan JavaScript/TypeScript projects for DPDP (Digital Personal Data Protection Act, 2023) compliance violations.
Catches common privacy issues: unguarded trackers, PII in localStorage, unconsented cookies, PII leaked to analytics, and missing privacy policy pages.
Install
npm install -g @dpdp-india/audit
# or
npx @dpdp-india/audit ./srcUsage
# Scan a directory
dpdp-audit ./src
# JSON output
dpdp-audit ./src --format json
# SARIF output (for GitHub Actions)
dpdp-audit ./src --format sarif --output report.sarif
# Run specific rules only
dpdp-audit ./src --rules no-unguarded-tracker,no-raw-pii-storage
# Ignore patterns
dpdp-audit ./src --ignore "tests/**,**/*.test.ts"Rules
| Rule | Severity | Description |
|------|----------|-------------|
| dpdp/no-unguarded-tracker | error | GA/GTM/FB/Hotjar/Clarity/Plausible must be loaded only after user consent |
| dpdp/no-raw-pii-storage | error | PII must not be stored in localStorage/sessionStorage without encryption |
| dpdp/no-unconsented-cookies | warning | document.cookie writes must be guarded by consent check |
| dpdp/no-third-party-scripts | error | HTML files must not include tracker <script> tags directly |
| dpdp/no-pii-in-analytics | error | PII fields must not be passed to analytics/tracking calls |
| dpdp/require-privacy-policy | warning | Project should have a privacy policy page or route |
| dpdp/no-unguarded-plausible | warning | PlausibleProvider must be wrapped in a consent check |
Programmatic API
import { scan } from '@dpdp-india/audit'
const result = await scan('./src', {
rules: ['no-unguarded-tracker'],
ignore: ['tests/**'],
})
console.log(result.violations)Next.js Plugin
Drop-in DPDP compliance for Next.js apps. Install and import from @dpdp-india/audit/next.
Setup
// app/layout.tsx
import { ConsentProvider, ConsentBanner } from '@dpdp-india/audit/next'
export default function RootLayout({ children }) {
return (
<html>
<body>
<ConsentProvider>
{children}
<ConsentBanner
privacyPolicyUrl="/privacy-policy"
companyName="Your Company"
/>
</ConsentProvider>
</body>
</html>
)
}Components
<ConsentProvider>
React context that manages consent state. Persists to dpdp_consent cookie.
<ConsentProvider
defaultAnalytics={false}
defaultMarketing={false}
defaultPreferences={false}
onConsentChange={(consent) => console.log(consent)}
>
{children}
</ConsentProvider><ConsentBanner>
Pre-styled consent banner with Accept All / Reject / Preferences UI.
<ConsentBanner
privacyPolicyUrl="/privacy-policy"
position="bottom" // 'top' | 'bottom'
showPreferences={true} // show granular category toggles
companyName="SPIC MACAY"
/>Categories: necessary (always on), analytics, marketing, preferences.
<DpdpScript>
Consent-aware replacement for Next.js <Script>. Only renders when category consent is given.
import { DpdpScript } from '@dpdp-india/audit/next'
// Only loads after user consents to analytics
<DpdpScript
consentCategory="analytics"
src="https://www.googletagmanager.com/gtag/js?id=G-XXXXX"
strategy="afterInteractive"
/><DpdpPlausible>
Consent-aware Plausible Analytics wrapper. Replaces next-plausible's PlausibleProvider.
import { DpdpPlausible } from '@dpdp-india/audit/next'
<ConsentProvider>
<DpdpPlausible
domain="spicmacay.org"
scriptSrc="/proxy/js/script.js"
apiUrl="/proxy/api/event"
>
{children}
</DpdpPlausible>
</ConsentProvider>useConsent() Hook
import { useConsent } from '@dpdp-india/audit/next'
function MyComponent() {
const { consent, hasConsent, acceptAll, rejectAll, updateConsent } = useConsent()
if (hasConsent('analytics')) {
// safe to load analytics
}
}Build-time Audit
Add withDpdpAudit to next.config.js to run compliance checks during build:
// next.config.js
import { withDpdpAudit } from '@dpdp-india/audit/next'
const nextConfig = { /* ... */ }
export default withDpdpAudit(nextConfig, {
enabled: true, // default: only in development
failOnError: false, // set true to block builds with violations
ignore: ['node_modules/**', '.next/**'],
})Framework Detection
Auto-detects: Next.js, React, Angular, Vue, Svelte.
Output Formats
- terminal (default) — colored output with file:line references and fix suggestions
- json — structured JSON for tooling integration
- sarif — SARIF 2.1.0 for GitHub Code Scanning
Development
bun install
bun run build
bun testLicense
MIT