npm-security-guard

npm-security-guard is a simple CLI tool that automatically scans your project’s dependencies and warns you about outdated or risky packages during every install. It helps you keep your Node.js projects secure by highlighting which dependencies need an update and providing quick fix commands.

✨ Features

Automatic Scanning: Runs right after each npm install to detect vulnerable or outdated dependencies.

Real-time Watch Mode: Continuously monitors package.json for changes.

Clear CLI Output: Shows a neat report with color-coded results and one-line update instructions.

Lightweight: Uses only a few dependencies (chalk, ora, chokidar, node-fetch).

📦 Installation Local Installation (as a dev tool) npm install npm-security-guard --save-dev

Then you can run:

npx npm-security-guard

Global Installation (recommended for system-wide use) npm install -g npm-security-guard

After that, you can run the command anywhere:

npm-security-guard

🚀 Usage

Basic Scan

Run a one-time security scan of the current project:

npm-security-guard

Watch Mode

Start continuous monitoring:

npm-security-guard --watch

The tool will re-scan automatically whenever package.json changes.

Automatic Scan on Install

If installed locally, the tool’s postinstall script automatically triggers after every npm install.

🛠 How It Works

Reads your package.json and package-lock.json.

Fetches the latest versions of each dependency from the npm registry using node-fetch.

Compares installed versions with the latest versions.

Displays a report with:

Current installed version

Latest version

Suggested update command (e.g., npm install @latest).

Example output:

NPM Security Guard Report:

✖ [email protected] – Update to 4.0.3 ➜ Fix: npm install chokidar@latest

✖ [email protected] – Update to 8.2.0 ➜ Fix: npm install ora@latest

📂 Project Structure npm-security-guard/ ├─ bin/ │ └─ cli.js # CLI entry point ├─ lib/ │ └─ scanner.js # Core scanning logic ├─ package.json └─ README.md

🧰 Development

Clone the repo:

git clone https://github.com/yourusername/npm-security-guard.git cd npm-security-guard

Install dependencies:

npm install

Link globally for local testing:

npm link

Now run npm-security-guard anywhere on your machine.

📤 Publishing to npm

Create an npm account if you don’t have one.

Login in your terminal:

npm login

Publish:

npm publish

⚙️ Requirements

Node.js ≥ 18

npm ≥ 8

📝 License

MIT License – feel free to use, modify, and distribute. //npm install -g npm-security-guard