DEV Community

CinfiniteDev
CinfiniteDev

Posted on

🕵️‍♂️ Dependencies Should Not Be Silent: Inspect What Your npm Packages Actually Do

#javascript #npm #security #opensource

SO ,

Every time you run:

npm install some-package
Enter fullscreen mode Exit fullscreen mode

you are executing someone else's code on your machine.

But here’s the uncomfortable truth:

Do you really know what that code is doing?

Most don’t.

🚀 From User to Producer: How I Realized the Risk

Before I first started building npm packages, I was just a user like everyone else. Install a package, trust it works, move on.

But when you switch from user → producer, everything changes: you see how packages execute, which scripts run automatically, and the sheer power even a tiny package can hold.

Then I read about this: npm supply-chain attack happened sometime back.

A single compromised package could affect millions of machines.

💡 That’s when I thought:

“Even a small package can impact huge systems. What if we could see what it does before we install it?”

That thought sparked npm-telemetry.

⚠️ The Problem With Blind Trust

npm packages can:

  • 🌐 Make network requests
  • 📁 Access the file system
  • 🔐 Read environment variables
  • ⚙️ Spawn child processes
  • 🧙 Execute dynamic code (eval / new Function)
  • 📦 Run postinstall scripts

Most developers only realize this after something goes wrong. Supply-chain attacks are becoming increasingly common — and frighteningly easy.

npm-telemetry gives visibility upfront, letting you make informed decisions before installing.

🛠 Introducing npm-telemetry

npm-telemetry is a lightweight CLI and Node.js library that inspects packages and reports on their capabilities.

Think of it as a nutrition label for npm packages: you inspect, you understand, you trust consciously.

What It Detects

  • 🌐 Network access
  • 📁 File system read/write
  • 🔐 Environment variable access
  • ⚙️ Child processes
  • 🧙 Dynamic execution (eval / new Function)
  • 📦 Postinstall scripts

It also calculates an analysis coverage score, so you know how thoroughly the package was inspected.

🏃‍♂️ Getting Started

No global installation needed. Run:

npx npm-telemetry <package_name>
Enter fullscreen mode Exit fullscreen mode

Example:

npx npm-telemetry axios
Enter fullscreen mode Exit fullscreen mode

Output:

🔍 Analysis Report: axios
Permissions:
🌐 Network: YES
📁 FS Read: NO
📁 FS Write: NO
🔐 Env Access: NO
⚙️ Child Process: NO
⚠ Dynamic code execution: NO
⚠ Postinstall script: null
Enter fullscreen mode Exit fullscreen mode

✅ Instantly know what the package is capable of doing.

💻 Programmatic Usage

Integrate npm-telemetry into CI pipelines, dashboards, or custom scripts.

CommonJS 

const analyzePackage = require("npm-telemetry");

(async () => {
  const result = await analyzePackage("axios");
  console.log(result.coverage);
  console.log(result.report.network);
})();
Enter fullscreen mode Exit fullscreen mode

ES Modules 

import analyzePackage from "npm-telemetry";

const result = await analyzePackage("axios");
console.log(result.coverage);
console.log(result.report.network);
Enter fullscreen mode Exit fullscreen mode

Returned object:

{
  "package": "axios",
  "coverage": 92,
  "report": {
    "fsRead": false,
    "fsWrite": false,
    "network": true,
    "env": false,
    "childProcess": false,
    "usesEval": false,
    "dynamicRequire": false,
    "postinstall": null
  }
}
Enter fullscreen mode Exit fullscreen mode

🔬 How npm-telemetry Works

Under the hood:

  1. Scans package code for sensitive APIs
  2. Detects dynamic code (eval, new Function)
  3. Flags postinstall scripts
  4. Generates a coverage score

💡 No execution happens on your machine, keeping it safe.

[Package] 
    ↓
[npm-telemetry analysis] 
    ↓
[Permissions report & coverage score]
Enter fullscreen mode Exit fullscreen mode

🛡 Why This Matters

npm-telemetry:

  • Makes dependency behavior visible
  • Lets developers audit packages before installing
  • Helps enforce security policies
  • Enables custom risk scoring

Not to accuse packages, but to give developers conscious control.

💡 Philosophy

Every dependency should answer one question:

“What am I doing on your system?”

npm-telemetry provides visibility, honesty, and peace of mind.

Software shouldn’t be magic — trust should never be blind.

✅ Try It Yourself 

npx npm-telemetry <package_name>
Enter fullscreen mode Exit fullscreen mode

Inspect any npm package before installing it — you may be surprised at what you discover.

Here's the link to package : https://www.npmjs.com/package/npm-telemetry

Top comments (0)