NPM Package Verifier

Paste a package name. This runs the same three checks as the original CLI tool (typosquat similarity, download/update-recency heuristics, and install-script scanning) entirely in your browser, against the live npm registry.

try:

How it works

This is a browser port of npmPackageVerifier, a CLI tool that sits in front of npm install. The original keeps an offline SQLite database of ~5,700 high-impact packages, generates plausible typosquats of each one, and checks whether those typosquats actually exist on the registry, so at scan time it's mostly doing fast local lookups. A static site can't ship or query that database, so this demo narrows the comparison set to about 140 well-known packages and does everything else live:

Name similarity. Checks the input against the comparison list for Levenshtein distance ≤2, homograph substitutions (rn↔m, vv↔w, 0↔o, 1↔l), hyphen/underscore swaps, and combosquatting (name padded with an extra prefix or suffix).
Download & recency heuristics. If a likely target was found, compares weekly/monthly download counts and last-publish dates against it. If not, checks whether the package's own weekly and monthly numbers are internally consistent and how long it's been since it was last published.
Install script scan. Pulls the preinstall / install / postinstall scripts for the latest version from the registry manifest and runs them through eight regex rules (remote shell execution, base64 decoding, eval, environment access, system fingerprinting, and similar), the same rule set as scanInstallScripts.py in the original repo, minus the actual sandboxed install the CLI version performs.

Points from all three checks combine into a single score: under 5 is low risk, 5–9 is suspicious, 10+ is high risk, the same bands the CLI prints before asking whether to continue the install.

Stack

Original tool: Python, SQLite, npm registry API. source on GitHub.