trustdep

npm supply chain scanner — scan before you install.

npm audit only checks for known CVEs. trustdep works differently — it analyses every package's history and detects anomalies.

Why?

Between 2025 and 2026, the npm ecosystem experienced multiple major supply-chain attacks that exposed critical gaps in traditional dependency security tooling.

Sept 2025 — Shai-Hulud worm A large-scale supply-chain attack compromised 500+ npm packages through maintainer account takeovers and automated propagation across the ecosystem.

Sept 2025 — Chalk / Debug compromise A coordinated phishing-based attack led to the compromise of 18 widely used packages, including chalk and debug, which collectively account for approximately 2.6 billion weekly downloads. The malicious versions introduced browser-side payloads capable of runtime manipulation and crypto/Web3 transaction tampering.

Mar 2026 — Axios supply-chain attack The Axios package was compromised via a malicious "phantom dependency" injection, resulting in the distribution of a cross-platform RAT to downstream users, despite Axios being downloaded over 100 million times per week.

Common pattern These incidents were not traditional vulnerability exploits — they were trusted-publisher compromises and malicious package injections. This means they were not detected by standard tools like npm audit, since no CVE-based vulnerability existed at detection time.

Install

npm install -g trustdep

Usage

# Check a single package
trustdep check axios
trustdep check lodash@4.17.21

# Scan all dependencies in package.json
trustdep scan

# CI integration (exit 1 if risk > high)
trustdep scan --fail-on high --json

# Re-scan automatically when lock file changes
trustdep watch

CI Integration

# .github/workflows/security.yml
name: Supply Chain Check
on: [push, pull_request]

jobs:
  trustdep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - run: npx trustdep scan --fail-on high --json > trustdep-report.json
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: trustdep-report
          path: trustdep-report.json

What it Checks

Risk Levels

Configuration

trustdep.config.json or a "trustdep" key inside package.json:

{
  "trustdep": {
    "failOn": "high",
    "ignore": ["@company/*", "internal-*"],
    "threshold": 60,
    "cacheTtlHours": 24,
    "concurrency": 5
  }
}

Network Access

trustdep is a network-based scanner — it must reach a small set of public metadata APIs to do its job. Nothing else is contacted, no telemetry is sent, and package contents (tarballs) are never downloaded — only metadata is analysed.

All requests:

• are plain HTTPS GET/POST against the URLs listed above;
• carry a User-Agent of trustdep/<version> (+https://github.com/ali-bingul/trustdep);
• have a hard timeout (15–30 s) and a single retry;
• send no authentication, no tokens, no user identifiers, and no telemetry.

Responses are cached locally in ~/.trustdep/cache.db (SQLite). Use --no-cache to bypass the cache for a fresh fetch.

Contributing

git clone https://github.com/ali-bingul/trustdep
cd trustdep
npm install
npm run dev
npm test

License

MIT © 2026