Package Exports

npm-hardener
npm-hardener/dist/cli.js

This package does not declare an exports field, so the exports above have been automatically detected and optimized by JSPM instead. If any package subpath is missing, it is recommended to post an issue to the original package (npm-hardener) to support the "exports" field. If that is not possible, create a JSPM override to customize the exports field for this package.

Readme

NPM Hardener

Paranoid by default supply chain protection for developers. NPM Hardener automates security best practices with static pattern analysis to protect your projects from malicious dependencies.

🚀 Why NPM Hardener?

Traditional security tools only check for known vulnerabilities (CVEs). NPM Hardener provides proactive protection against:

Malicious Scripts: Automatically blocks preinstall and postinstall scripts.
Credential Theft: Detects access to environment variables (AWS, GCP, etc.).
Exfiltration: Flags suspicious network requests and file system access.
Obfuscation: Identifies hex-encoded payloads and obfuscated code.

🎨 Features

🔒 Secure Initialization (`npm-hardener init`)

Configures your project with hardened settings in .npmrc:

ignore-scripts=true — Blocks all package lifecycle scripts.
save-exact=true — Pins exact dependency versions.
minimum-release-age=10080 — 7-day cooldown for new packages.
node-options="--permission" — Enables Node.js experimental permissions.
Creates AGENTS.md for AI assistant security guidelines.

📦 Safe Installation (`npm-hardener install`)

The core command for adding and updating dependencies:

Auto-PM Detection: Works with npm, pnpm, yarn, and bun.
Safe Download: Runs the installation with scripts disabled.
Threat Scan: Scans the downloaded packages for suspicious patterns.
Interactive Gatekeeping: If HIGH severity threats are found, it prompts for permission before finishing.
Auto-Cleanup: Automatically deletes node_modules if you abort the installation.

🔍 Manual Scanning (`npm-hardener scan`)

Audit your existing node_modules at any time for potential threats with detailed tree-style reporting and code snippets.

📋 Requirements

Node.js >= 18.0.0 (Required for the Node.js Permission Model and ESM support)
NPM >= 8.0.0

🛠 Installation

Recommended (No Installation)

Use npx to run the latest version without global permission issues:

npx npm-hardener init

Global Installation

npm install -g npm-hardener

Note: If you encounter EACCES errors, we recommend using npx or a version manager like nvm.

📖 Usage

Secure a new project

npm-hardener init

Install a new package safely

npm-hardener install <package-name>

Scan current dependencies

npm-hardener scan

🎨 Premium Aesthetic

Built with a modern CLI experience:

Cyberpunk Branding: High-fidelity 256-color gradient logo.
Tree-View Reports: Logical grouping of threats by package.
High-Contrast Badges: Instant identification of severity levels.
Platform Aware: Custom logic for Windows (PowerShell) and Unix shells.

⚖️ License

MIT

npm-hardener