JSPM

Node.js supply-chain enforcement at install and at runtime. Policy-gated lifecycle scripts, caller-chain-attributed runtime hook.

Execute npm/yarn lifecycle scripts with pre/post script support - 執行 npm/yarn 生命週期腳本，支援前置/後置腳本

Install script firewall for npm - default-deny lifecycle scripts with explicit, reviewable allowlists

Audit npm package-lock install hooks with a small explicit allowlist.

Human-readable, risk-aware diffs for package-lock.json in pull requests

Scan npm packages for malicious lifecycle scripts before installing them

Supply-chain blast-radius visualizer that traces npm install-time lifecycle scripts, file/network access, and secret-canary reads.

npm supply chain security guardian — detects ghost dependencies, scores install script behavior, catches the axios blind spot, and blocks known malicious packages before they execute