npxray

X-ray vision for npx. npxray replaces the blind "Ok to proceed? (y)" prompt with a deterministic, inspectable package risk report — built from public npm registry data, no API keys required.

npx npxray inspect create-vite@latest

What it does

npx asks for trust while giving almost no evidence. npxray turns that moment into a report you can actually read:

• package age and version freshness
• maintainer count and dependency fan-out
• lifecycle scripts that run during install
• executable bin entrypoints
• tarball size, file count, and selected file previews
• suspicious code signals (shell execution, remote download, dynamic eval, secret access, encoded payload markers)

It is a risk profiler, not a malware sandbox: findings are explainable signals meant to slow down dangerous npx muscle memory. It does not execute package code.

Usage

# Inspect a package or a full npx command
npxray inspect create-vite@latest
npxray inspect "npx shadcn@latest init"
npxray inspect tsx --json
npxray inspect create-vite@latest --markdown
npxray inspect create-vite@latest --no-tarball

# Guarded run: review, then delegate approved commands to npm exec
npxray run -- create-vite@latest my-app --template react
npxray run --dry-run -- create-vite@latest my-app --template react

Alias experiment:

alias npx='npxray run --'

The alias delegates approved commands to npm exec -- ..., avoiding shell alias recursion.

License

MIT