NPM Hardener

Paranoid by default supply chain protection for developers. NPM Hardener automates security best practices with static pattern analysis to protect your projects from malicious dependencies.

🚀 Why NPM Hardener?

Traditional security tools only check for known vulnerabilities (CVEs). NPM Hardener provides proactive protection against:

• Malicious Scripts: Automatically blocks preinstall and postinstall scripts.
• Credential Theft: Detects access to environment variables (AWS, GCP, etc.).
• Exfiltration: Flags suspicious network requests and file system access.
• Obfuscation: Identifies hex-encoded payloads and obfuscated code.

🎨 Features

🔒 Secure Initialization (npm-hardener init)

Configures your project with hardened settings in .npmrc:

• ignore-scripts=true — Blocks all package lifecycle scripts.
• save-exact=true — Pins exact dependency versions.
• minimum-release-age=10080 — 7-day cooldown for new packages.
• node-options="--permission" — Enables Node.js experimental permissions.
• Creates AGENTS.md for AI assistant security guidelines.

📦 Safe Installation (npm-hardener install)

The core command for adding and updating dependencies:

1. Auto-PM Detection: Works with npm, pnpm, yarn, and bun.
2. Safe Download: Runs the installation with scripts disabled.
3. Threat Scan: Scans the downloaded packages for suspicious patterns.
4. Interactive Gatekeeping: If HIGH severity threats are found, it prompts for permission before finishing.
5. Auto-Cleanup: Automatically deletes node_modules if you abort the installation.

🔍 Manual Scanning (npm-hardener scan)

Audit your existing node_modules at any time for potential threats with detailed tree-style reporting and code snippets.

📋 Requirements

• Node.js >= 18.0.0 (Required for the Node.js Permission Model and ESM support)
• NPM >= 8.0.0

🛠 Installation

Recommended (No Installation)

Use npx to run the latest version without global permission issues:

npx npm-hardener init

Global Installation

npm install -g npm-hardener

Note: If you encounter EACCES errors, we recommend using npx or a version manager like nvm.

📖 Usage

Secure a new project

npm-hardener init

Install a new package safely

npm-hardener install <package-name>

Scan current dependencies

npm-hardener scan

🎨 Premium Aesthetic

Built with a modern CLI experience:

• Cyberpunk Branding: High-fidelity 256-color gradient logo.
• Tree-View Reports: Logical grouping of threats by package.
• High-Contrast Badges: Instant identification of severity levels.
• Platform Aware: Custom logic for Windows (PowerShell) and Unix shells.

⚖️ License

MIT