zigamedved/chain

chain is a command line tool that checks how risky your project's dependencies are before and after you install them. It looks across all your projects at once and gives a quick dashboard showing how many packages each one uses, whether a lockfile exists, and whether anything looks suspicious. It focuses on four kinds of risk. First, lifecycle scripts, which are pieces of code that packages can run automatically during install, something that could be used to run malicious code on your machine without you noticing. Second, known security vulnerabilities, checked against the public OSV.dev database, covering npm, Go modules, and Python's PyPI. Third, missing lockfiles, since without one an install can quietly pull in different package versions than the ones that were actually tested. Fourth, typosquatting, where a package name is suspiciously close to a popular one, a common trick attackers use to trick people into installing the wrong package. The tool works through a few simple commands. Running chain alone shows the dashboard across every project it knows about. Chain preview looks closely at one project, listing lifecycle scripts and vulnerabilities before you even run npm install. Chain audit is meant for continuous integration pipelines, exiting with an error code if it finds anything above a chosen severity level, so a bad dependency can block a build automatically. Chain init walks a user through picking which project folders to scan the first time they set it up. For each type of problem it finds, the readme also explains what to actually do about it, like upgrading a package, pinning a safe version with an override, committing a lockfile, or removing a package that turns out to be a typosquat. It installs through Homebrew or by building from source with Go, requires no account or API key for its vulnerability checks, and can run fully offline if needed. It is released under the MIT license.