Check your npm packages for risky dependencies by @shipcheck
For anyone shipping a JavaScript app: find the npm packages that could hurt you before an attacker does. Reads package.json and package-lock.json and flags look-alike package names one typo from a popular one, packages installed straight from git or a URL, versions like "*" or "latest", packages that run scripts on install, a missing or stale lockfile, and known vulnerabilities from npm audit, then walks you through each fix. Never installs or runs a package.
NewTested