Verification · Supply chain · Dependency risk assessment
Malicious package heuristics
Scan package contents for install-time scripts, obfuscation and exfiltration.
How to build it
- Run a package heuristic scan on each new dependency before its first install.
- Check install-time scripts, obfuscated code and network calls in the package contents.
- Hold the change until a reviewer clears any flagged package.
Signals in a repository
- A guarddog command or workflow step run on new dependency lines.
- A CI job that scans package manifests when they change.
- A recorded exception list that names packages cleared by a reviewer.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.