How do I check if an npm package is malicious?

Query PkgRadar's public API: GET https://pkgradar.com/api/public/pkg?ecosystem=npm&name= . It returns a risk verdict, static findings, and any campaign attribution. PkgRadar statically analyzes new npm releases and never executes package code.

How do I block malicious packages in CI/CD?

Add the PkgRadar gate to your pipeline. The CLI auto-detects lockfiles (package-lock.json, poetry.lock, Cargo.lock, and more) and the API gates a build before a flagged dependency is installed, so a compromised package is blocked pre-merge rather than after it reaches production.

Does PkgRadar execute package code?

No. PkgRadar is static-only. It treats each package as hostile data — unpacking and analyzing it without ever running install hooks or package code — which lets it inspect malware safely and at scale.

Which ecosystems does PkgRadar support?

Nine: npm, PyPI, RubyGems, Cargo, Maven, NuGet, Composer, Go, and Pub. The same detection gate and clustering applies across every registry.

How fast does PkgRadar detect new malware?

Continuously. Each ecosystem's hunter scans fresh releases on a rolling loop, and on overlapping malware PkgRadar often flags the package before the corresponding public OSV advisory — see the coverage page for the live lead-time figure.

What kinds of supply-chain attacks does PkgRadar catch?

Credential and token exfiltration, install-hook (pre/post-install) abuse, obfuscated payloads, and prompt-injection-in-package attacks that target AI coding agents. It maps real incidents like Shai-Hulud, tj-actions/changed-files, and event-stream to the static indicators it hunts.

For platform & security teams

Catch malicious packages before the advisory exists.

PkgRadar statically scans every new release across nine ecosystems and gates it in your CI — blocking a compromised dependency before it's ever installed. Typically hours to days before the public OSV advisory exists.

3M+releases scannedstaticnever-executed analysis

Start free — 25 scans / mo See live intelligence

Flagged-first receipts →Audited accuracy vs Socket & Snyk

Free instant verdict, no signup — see static findings and any campaign link for a scanned release. Want it on every PR? Start free — 25 scans/mo.

Drop it into your pipeline

Block malicious dependencies in the pull request — one step.

The composite GitHub Action scans every changed dependency and fails the check before a compromised package merges. Auto-detects npm, PyPI, Cargo and more lockfiles. CLI, fail-on threshold & self-host options →

# .github/workflows/pkgradar.yml — gate every PR
- uses: PkgRadar/pkgradar-cli@v1
  env:
    PKGRADAR_TOKEN: ${{ secrets.PKGRADAR_TOKEN }}

Coverage by ecosystem

The same gate, nine registries. Per-ecosystem detail →

npm0scanned0 high PyPI0scanned0 high RubyGems0scanned0 high Cargo0scanned0 high Maven0scanned0 high NuGet0scanned0 high Composer0scanned0 high Go modules0scanned0 high Pub (Dart)0scanned0 high

Candidate cluster queue

CandidateStatusEvidenceAffectedTop signalLast seen

Publisher / release actor burstGitHub Actions

Awaiting OSV

Strongevidence

7755releases

Publisher / release actor burst

Current corpus

Repeated static TTPjs_hidden_powershell:hidden / non-interactive powershell invocation in package code — `-windowstyle hidden`, `irm | iex`, `windowshide: true`, or equivalent — used to download-and-run payloads on windows installers.

Awaiting OSV

Strongevidence

6125releases

Repeated static TTP

Current corpus

Repeated static TTPjs_remote_exe_exec:downloads a windows executable (.exe/.msi/.scr/.dll/script) from a url and runs it via child_process — remote-payload dropper.

Awaiting OSV

Strongevidence

4410releases

Repeated static TTP

Current corpus

Repeated static TTPjs_remote_npm_install:shell-exec of `npm install` with a global flag, a url, or a concatenated (dynamic) target — installs a remote/attacker-controlled package at runtime (self-updating dropper / remote payload).

Awaiting OSV

Strongevidence

3887releases

Repeated static TTP

Current corpus

Repeated static TTPnative_binary_main_entry:main/bin entry points to a compiled binary: bin entry

Awaiting OSV

Strongevidence

3463releases

Repeated static TTP

Current corpus

View all candidates

High-signal release queue

PackageVerdictScoreWhy flaggedAction

No high-signal releases stored yet.

Review release evidence

Detection model

From registry update to build decision

Research notes

Registry feedFresh package updates

Static unpackNo install or execution

Manifest diffBehavior changes

TTP extractionCredential and CI signals

Candidate correlationShared evidence

CI decisionBlock or monitor

API verdict

Review

{
  "package": "package@version",
  "verdict": "review",
  "score": 42,
  "mode": "static",
  "decision": "review"
}

CI gatecurl -X POST /gate/npm -H 'Authorization: Bearer $PKGRADAR_TOKEN'

Real attacks

Built to catch the supply-chain attacks teams actually face.

Shai-Hulud worm. tj-actions/changed-files takeover. ua-parser-js postinstall miner. event-stream / flatmap-stream. colors.js + faker.js sabotage. polyfill.io takeover. @solana/web3.js key exfiltration. We map each one to the static indicators PkgRadar already hunts.

See the full list

Audit-ready evidence

Evidence that maps to SOC 2, NIST SSDF, ISO 27001 & the EU CRA.

Every static finding, gate decision, and campaign record is an artifact your auditor can sample. The /trust page enumerates the exact controls PkgRadar evidences — CC7 monitoring, CC8 change management, NIST SSDF PW.4 dependency verification, ISO 27001 A.5.21 supply chain, and EU CRA due-diligence obligations.

Read the trust mapping

SOC 2CC7 monitoring · CC8 change mgmt · CC9 vendor risk
NIST SSDF v1.1PW.4 dependency review · PW.7 analysis · RV.1
ISO 27001:2022A.5.21 supply chain · A.8.28 secure coding
EU CRAAnnex I §1+§2 · Article 13 due diligence