NPMscan/npmscan-action
Resource
Can I trust it?
No red flags in our checks.
Stars from real accounts No data
We haven't checked its stars for fakes yet.
Active OK
Last change today.
Licence OK
MIT: you can use it for free, also in a commercial product. Keep the licence notice.
Quick checks from public data. They help, but they are no guarantee.
What it is
A GitHub Action that scans pull requests changing package.json or lockfiles for known vulnerabilities and malware, new install scripts, repointed lockfile tarballs, and changed overrides. It posts a PR comment and can fail the check based on configurable thresholds.
Who it's for
Developers and maintainers who manage npm projects on GitHub and want dependency change checks in pull requests
How to use it
Install
uses: npmscan/npmscan-action@v1From its README. Check it there before running it.
Ask your AI to set it up
Paste this into Claude, ChatGPT or your coding assistant.
Help me install and set up NPMscan/npmscan-action in my project. Follow its README: https://github.com/NPMscan/npmscan-action. Explain each step and check it is safe before running anything.
Star curve
On the radar
Its place among the radar's top 100, day by day, with #1 at the top. Gaps are days it was out of the top 100.
Records
- Best place on RepoAlerts: #80, on 25 Oct 2026
Alternatives
Similar projects named in its profile. Each link searches the directory.
Get alerts for repos like this
We'll email you when something in Dev infrastructure starts rising. Free, once a week, only what matches.
20,109 GitHub repos watched and ranked every hour. Figures as of 25 October 2026.
What arrives: one email on Mondays with the repos that match, never more. See last week's. Privacy
For maintainers
Add this badge to your README. It shows the repo's place on the radar, updates every hour and links back to this page.
[](https://repoalerts.com/repo/NPMscan/npmscan-action?ref=badge)Similar repos
- Spectrmachina/Ztrust
A zero-trust supply-chain security scanner for open source projects. It detects vulnerable and malicious dependencies, typosquats, leaked secrets, unsafe lockfiles and dangerous GitHub Actions workflo
- Cygnux-Labs/Tracekit
A Python tool that gates and records every tool and model call an AI agent makes. Each call and decision is signed into a hash chain, exported as a .tkb file per run, and can be verified offline. Edit
- Aletheore/Aletheore
Command-line tool that runs a deterministic scan of a repository and writes structured evidence: dependency graph, secrets, git-history secret sweep, dependency vulnerabilities, and API endpoints. It
- getalden/alden
A local review companion for GitHub pull requests that ranks PRs waiting on your review, shows callers of changed public code outside the diff, and lists the places that need attention. It can use an
- BastionPHP/Bastion
Assesses PHP installations for patch state using upstream versions, package metadata, vendor fix data and running-process evidence, and scans web roots and logs for intrusion indicators. Results are r
- trhhubsd/ARTEX
Autonomous AI penetration testing system written in Go with a Next.js web UI. It runs LLM-driven agents against targets, records traffic through a proxy, syncs assets from ScopeSentry, and tracks find