@workingmodel/what-is-this-package-actually-doing

Runs an npm package and tells you what it actually does — network calls, file writes, child processes, credential snooping. Developed by Working Model.

Installing some-package in sandbox…

what-is-this-package-actually-doing
Package: [email protected]
Says what it does: A helpful utility library

Running with tracer…

✖ [Telemetry] Makes outbound calls to known telemetry services on require: ingest.sentry.io
  This package phones home when imported — before you do anything with it.

⚠ [Install Script] some-package runs a script on install (postinstall).
  Install scripts execute arbitrary code during npm install — before you've reviewed anything.

⚠ [Child Process] Spawns 1 child process(es) on require: git rev-parse HEAD
  Spawning processes at require-time is unusual. Check what these commands do.

Summary: 1 error, 2 warnings
This package behaves suspiciously. Review before using.

Install

npx @workingmodel/what-is-this-package-actually-doing <package-name>

Or install globally:

npm install -g @workingmodel/what-is-this-package-actually-doing

Usage

what-is-this-package-actually-doing lodash
what-is-this-package-actually-doing [email protected]

Exits with code 1 if errors are found, 0 if clean.

What It Checks

| Check | What it catches | |-------|----------------| | Telemetry | Outbound calls to Sentry, Segment, Mixpanel, Amplitude, and other known tracking services at require-time | | Network calls | Any outbound HTTP/HTTPS request made just by importing the package | | File writes | Writes to ~/.ssh, ~/.aws, ~/.gnupg, or anywhere outside /tmp at require-time | | Sensitive reads | Reads of SSH keys, AWS credentials, .env files, .npmrc | | Child processes | Shell commands spawned on require — especially rm -rf, curl\|sh, sudo | | Install scripts | preinstall/install/postinstall hooks that run arbitrary code during npm install |

How It Works

The tool installs the package into a temporary sandboxed directory, then runs it through Node.js with a preload script that intercepts calls to http, https, fs, and child_process. It reports everything suspicious that fires on require — before you ever run the package in your own project.

The sandbox is cleaned up automatically after the scan.

Why This Exists

You found a package on npm. It has 2 million weekly downloads. The readme says it's a date formatter. You install it and suddenly your CI is making outbound calls to an analytics service you never signed up for. Or worse.

Most developers never find out what a package actually does at runtime. This tool runs it first and tells you.

More tools from Working Model → workingmodel.co · npm @workingmodel