mitnick

Pre-install security analysis CLI for npm packages. Analyze packages before installation to detect vulnerabilities, malicious code, typosquatting, and supply chain attacks.

Named after Kevin Mitnick, one of the most famous security experts in history.

Why?

npm supply chain attacks are escalating. In 2025 alone, packages like debug and chalk (2.6B+ weekly downloads) were compromised. Existing tools like npm audit only work after installation — by then, malicious postinstall scripts have already executed.

mitnick fetches and analyzes package tarballs from the npm registry without ever executing their code. Nothing runs on your machine except mitnick itself.

Install

npm install -g mitnick

Or use directly with npx:

npx mitnick check express

Usage

# Check a single package
mitnick check express

# Check a specific version
mitnick check [email protected]

# Check multiple packages at once
mitnick check express lodash chalk

# JSON output for scripts and tooling
mitnick check --json express

# SARIF output for GitHub Security tab
mitnick check --sarif express

# CI mode — exit code 1 if any finding meets the severity threshold
mitnick check --fail-on high express

# Verbose output with extra details
mitnick check --verbose express

Output

  mitnick v1.0.0 — Security Analysis

  Checking [email protected]...

  ✓ Vulnerability Scanner     2 findings
  ✓ Install Scripts           0 findings
  ✓ Typosquatting             0 findings
  ✓ Obfuscation               0 findings
  ✓ Network Calls             1 finding
  ✓ Sensitive Data            0 findings
  ✓ License                   0 findings
  ✓ Maintainer                1 finding
  ✓ Dependency Confusion      0 findings
  ✓ Dormant Package           0 findings
  ✓ Prototype Pollution       0 findings

  Score: 79/100 (C)

  ┌──────────┬──────────┬──────────────────────────────────────┐
  │ Severity │ Analyzer │ Finding                              │
  ├──────────┼──────────┼──────────────────────────────────────┤
  │ HIGH     │ Vuln     │ CVE-2024-XXXX in [email protected]           │
  │ MEDIUM   │ Vuln     │ CVE-2024-YYYY in [email protected] │
  │ MEDIUM   │ Network  │ Uses http module for outbound calls  │
  │ LOW      │ Maint    │ Single maintainer (bus factor = 1)   │
  └──────────┴──────────┴──────────────────────────────────────┘

  Analyzed in 1.2s

Security Analyzers

mitnick runs 11 security analyzers on every package:

| Analyzer | What it detects | |----------|----------------| | Vulnerability Scanner | Known CVEs via the OSV database and GitHub Advisory DB | | Install Scripts | preinstall/postinstall hooks with suspicious commands (curl, wget, eval, shell spawning) | | Typosquatting | Package names suspiciously similar to popular packages (Levenshtein distance, character substitution) | | Obfuscation | High-entropy strings, eval(), new Function(), Base64 blobs, hex-encoded code | | Network Calls | fetch(), http.request(), axios/got imports, hardcoded IP addresses | | Sensitive Data | process.env harvesting, access to ~/.ssh, ~/.aws, ~/.npmrc, credential files | | License | Missing licenses, copyleft (GPL/AGPL), SPDX compliance | | Maintainer | Single-maintainer risk (bus factor), new/inactive accounts | | Dependency Confusion | Public packages mimicking internal/private naming patterns | | Dormant Package | Packages reactivated after long inactivity (common attack vector) | | Prototype Pollution | __proto__ access, Object.prototype mutation, unsafe merge functions |

Scoring

Each package gets a score from 0 to 100 based on findings:

| Severity | Points deducted | |----------|----------------| | Critical | -25 | | High | -15 | | Medium | -8 | | Low | -3 | | Info | 0 |

| Score | Grade | |-------|-------| | 90-100 | A | | 80-89 | B | | 70-79 | C | | 50-69 | D | | 0-49 | F |

CI/CD Integration

Exit codes

Use --fail-on to fail your pipeline when findings meet a severity threshold:

# Fail if any critical or high severity finding exists
mitnick check --fail-on high express

Exit code 1 means findings were found at or above the threshold. Exit code 0 means the package passed.

GitHub Actions

- name: Security check dependencies
  run: npx mitnick check --fail-on medium $(cat package.json | jq -r '.dependencies | keys[]')

SARIF upload to GitHub Security tab

- name: Run mitnick
  run: npx mitnick check --sarif express > results.sarif

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Requirements

• Node.js >= 18.0.0

Development

# Clone and install
git clone https://github.com/muratdemirci/mitnick.git
cd mitnick
npm install

# Build
npm run build

# Run tests (298 tests)
npm test

# Run tests with coverage
npm run test:coverage

# Type check
npm run typecheck

Architecture

src/
├── cli/          CLI entry point, commands, formatters (terminal/JSON/SARIF)
├── core/         Analysis engine, scoring system, shared types
├── registry/     npm registry client, tarball download and extraction
├── analyzers/    11 security analyzers (each implements Analyzer interface)
└── utils/        AST parsing, HTTP client, filesystem helpers, logger

All analyzers implement a shared Analyzer interface and are executed in parallel. Adding a new analyzer requires zero changes to existing code (Open/Closed Principle).

License

MIT