All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
- Initial release
- Zero-dependency package security validation tool
- Support for npm, yarn, pnpm, and bun
- JSON blacklist validation (795+ compromised packages from Shai-Hulud worm)
- npm audit integration
- Automatic JSON updates when vulnerabilities detected
- User-wide and per-repository installation options
- Professional CLI interface
- Lockfile validation
- package.json validation
- Repository scanning command
- Dev dependency support
- HTTP endpoint support for blacklist
- Local folder support for blacklist
- Vulnerability provider integration (OSV, GitHub Advisories, Snyk)
- Real-time vulnerability checks before installation
- Provider configuration via config file and CLI arguments
- Shell alias management commands (
add aliases,remove aliases) - Status command for installation verification
- Init command for config file generation
- Unified
scancommand with intelligent target detection - Log mode configuration (verbose, normal, quiet)
- Zero external dependencies for maximum security
- Uses only Node.js built-in modules
- Pre-installation package validation
- Custom blacklist support
- Real-time vulnerability database integration
- Pre-install blocking of compromised packages