depintel

Dependency intelligence for Node.js — scan your node_modules for security threats, supply chain risks, and edge runtime compatibility issues.

What it does

depintel statically analyzes your installed dependencies to surface security risks, supply chain anomalies, and edge runtime incompatibilities. It parses source code into ASTs to detect dangerous patterns like eval() usage, child process spawning, and network calls — then cross-references lockfile changes to catch typosquatting, integrity tampering, and suspicious version jumps.

Quick Start

npm install -g depintel

# Scan your project
depintel scan

# Check in CI (exit code 1 on findings)
depintel check

CLI Commands

| Command | Description | Key Flags | |---------|-------------|-----------| | depintel scan [path] | Scan node_modules for security threats and compatibility issues | --edge, --severity, --format, --verbose | | depintel check [path] | CI-friendly check with exit codes (0=clean, 1=findings, 2=error) | --edge, --severity, --format, --verbose | | depintel diff [path] | Analyze lockfile changes vs git HEAD | --ref, --format, --verbose | | depintel init [path] | Generate a .depintel.yaml config file | --force |

Common Flags

• --severity <level> — Minimum severity to report: critical, high, medium, low, info
• --edge <runtimes> — Edge runtimes to check (comma-separated): cloudflare, vercel
• --format <type> — Output format: terminal, json, sarif (SARIF requires Pro)
• --verbose — Enable verbose logging

Built-in Rules

Security

| Rule | Severity | Description | |------|----------|-------------| | security/eval-usage | Critical | Detects eval() and new Function() — arbitrary code execution | | security/child-process | Critical | Detects exec, spawn, fork — arbitrary system commands | | security/install-scripts | High | Detects suspicious preinstall/postinstall scripts | | security/fs-access | Medium | Detects filesystem read/write operations | | security/network-calls | Medium | Detects HTTP/HTTPS/fetch calls that could exfiltrate data | | security/env-access | Low | Detects process.env access targeting sensitive variables |

Supply Chain

| Rule | Severity | Description | |------|----------|-------------| | provenance/cooldown | High | Flags packages published within a configurable cooldown period (default: 7 days) | | provenance/attestation | Medium | Checks for npm provenance attestation (Sigstore) |

Edge Compatibility

| Rule | Severity | Description | |------|----------|-------------| | edge/node-api-usage | Info | Detects Node.js built-in module usage that may break in edge runtimes | | edge/cloudflare-compat | Medium | Checks compatibility with Cloudflare Workers | | edge/vercel-edge-compat | Medium | Checks compatibility with Vercel Edge Runtime |

Lockfile Analysis

The diff command analyzes lockfile changes (npm, yarn, pnpm) to detect:

• Typosquatting — Levenshtein distance analysis against popular package names
• Integrity changes — Hash changes without version changes (possible package hijack)
• Missing integrity — Newly added packages without integrity hashes
• Major version jumps — Version increments >1 major version

Configuration

Generate a config file with depintel init, then customize:

# .depintel.yaml

# Minimum severity level to report
severity: medium

security:
  enabled: true
  cooldown:
    days: 7              # Flag packages published within N days
  provenance:
    enabled: true        # Check for npm provenance attestation

edge:
  enabled: false
  runtimes: []           # cloudflare, vercel

ignore:
  packages: []           # Packages to exclude from scanning
  rules: []              # Rule IDs to disable (e.g. "security/eval-usage")

output:
  format: terminal       # terminal, json, sarif
  color: auto            # auto, always, never

Output Formats

Terminal (default) — Color-coded findings grouped by package, with code snippets and suggestions.

JSON — Structured output with metadata, findings array, and severity counts. Suitable for scripting and integrations.

SARIF — SARIF 2.1.0 output for GitHub Code Scanning integration. Requires Depintel Pro.

Depintel Pro

Unlock advanced detection and CI integrations with Depintel Pro.

| Feature | Free | Pro | |---------|:----:|:---:| | 11 built-in rules (security, supply chain, edge compat) | Yes | Yes | | Lockfile analysis (typosquat, integrity, version jumps) | Yes | Yes | | Terminal and JSON output | Yes | Yes | | SARIF 2.1.0 output (GitHub Code Scanning) | | Yes | | Advanced obfuscation detection (9 patterns) | | Yes |

Pro Obfuscation Detection

Depintel Pro detects sophisticated obfuscation techniques used to hide malicious code:

• Hex-encoded strings
• Character code concatenation
• Reverse string execution
• Dynamic require() / import()
• Embedded webhook URLs
• Raw IP address URLs
• Environment variable exfiltration
• Base64-encoded environment access
• Suspicious string construction patterns

Pricing

$9/mo or $79/yr

Get started at depintel.akoslabs.co

License

MIT