NPM Package Scanner

Supply Chain Risk Intelligence

PlayCISO runs this scanner every day against the most-downloaded npm packages — scoring each one against 50 risk policies covering install scripts, ownership changes, typosquats, obfuscation, and more. Paid users can download the same scanner and run it against their own repos and packages.

1,000
Packages scanned
0
Critical risk found
0
High risk found
8/1/2026
Last scan

Risk distribution

critical0 (0%)
high0 (0%)
medium0 (0%)
low1000 (100%)

Most triggered policies

Single maintainer, high downloads113
sp-missing-readme72
Wildcard dependency versions2

How the scanner works

1

Lead discovery

Finds high-download npm packages using 10 lead-scoring policies — weighing download surface, maintainer count, ownership changes, and install scripts.

2

Policy scan

40 scan policies run against each lead — checking for malicious install scripts, env exfiltration, obfuscated eval, typosquats, abandoned packages, and more.

3

Risk scoring

Each package gets a 0-100 risk score and a Critical/High/Medium/Low rating. Full evidence logged per policy hit so you know exactly what triggered.

Run it in your own environment

Paid users can download the same scanner and point it at their own package lists, repos, or private registries — with one command.

npx @playciso-scanner/npm-scanner --token <your-token>
NPM Package Scanner · PlayCISO