Writing··9 min read
What I Learned Auditing 10,000 npm Packages
Supply chain risks, phantom dependencies, and why install scripts remain JavaScript's largest security blind spot.
#Security#Node.js#Open Source
Active·Independent Project
SlopFree
“Detect suspicious dependencies before they enter your project.”
OVERVIEW
SlopFree is a lightweight CLI and pre-commit hook that analyzes npm dependencies before installation. It detects typosquatting, hidden install lifecycle scripts, obfuscated payload strings, and newly published unvetted maintainer accounts.
HOW IT WORKS
When invoked via `npx slopfree check` or integrated into `pre-install`, SlopFree intercepts package resolution. It fetches registry metadata, builds an AST of all lifecycle scripts (`preinstall`, `postinstall`), runs heuristic entropy checks to flag obfuscated code, and cross-references package age with maintainer reputation heuristics.
ARCHITECTURE
Built as a zero-daemon standalone CLI in TypeScript. Employs a streaming tarball unpacker, SWC for microsecond AST parsing of lifecycle scripts, and a deterministic heuristic scoring engine that outputs structured JSON or human-readable terminal alerts.
TECHNOLOGIES
TypeScriptNode.jsAST Analysisnpm Registry APIZod
DOCUMENTATION
Full documentation is available in our Journal under Documentation: [SlopFree Architecture & CLI Reference](/journal/documentation/slopfree-cli-reference).
CONNECTED KNOWLEDGE
Related Journal Entries
Experiments··7 min read
Can AI Rebuild a Website From a Screenshot?
Testing multimodal models on complex editorial typography, asymmetric grids, and responsive layouts.
#AI#Design#CSS
Documentation··6 min read
SlopFree Architecture & CLI Reference
Complete technical reference, installation guide, AST heuristics, and CI/CD integration.
#Documentation#SlopFree#CLI