Introducing jev-sec-audit

jev-sec-audit is a drop-in CLI tool and GitHub Action that audits your package.json for threats.

It has ZERO external dependencies. (Because installing 50 NPM packages to secure your NPM packages is ironic, right?)

When you run it, it instantly analyzes your dependency tree and scripts for:

🕵️ Typosquatting (e.g., catching lodsh instead of lodash)
🦠 Obfuscated Code (Base64 payloads, hidden evals)
🚨 Destructive Lifecycle Scripts (curl | bash hidden in postinstall)

🛠️ Try it right now (No installation required)

You can scan your project instantly in your terminal:

npx jev-sec-audit package.json

If it finds threats, it drops a beautiful, native-ANSI table right in your terminal detailing the exact risk level and confidence score:

Drop it into your GitHub Actions

You don't even need to use the CLI. You can secure your repository's Pull Requests right now by adding this to your .github/workflows/audit.yml:

name: Jev Security Audit
on: [pull_request]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Jev Sec Audit
        uses: DhanushNehru/jev-sec-audit@v1

Pull Request's are welcome !!!

Drop a ⭐️ on the GitHub Repository if you find this useful and let me know in the comments what features you'd like to see next!