pkgxray - npm Package Compare versions

Comparing version

1.0.1

1.0.2

+1

-1

package.json

		{
		"name": "pkgxray",
		"version": "1.0.1",
		"version": "1.0.2",
		"description": "Zero-dep local CLI and MCP server that scans npm packages for supply-chain risk. OSV vuln pre-check, sandboxed quarantine, tarball-integrity verification, calibrated static heuristics, GitHub provenance cross-check.",
		@@ -5,0 +5,0 @@ "license": "MIT",

+18

-12

README.md

		@@ -18,4 +18,10 @@ <div align="center">

		<img src="docs/banner.png" alt="pkgxray — a package under an x-ray scan beam next to the SAFE / REVIEW / BLOCK verdict chips" width="820">
		<img src="docs/demo/hero.gif" alt="pkgxray guard clearing express@4.21.0 with a SAFE A+ verdict, then blocking a trojaned sample with a BLOCK F verdict and a HIGH credential-access finding citing the wallet-read and exfiltration code" width="820">

		<sub>Real runs, recorded live: `guard` clears `express@4.21.0` (with the npm ↔ GitHub
		cross-check), then blocks a malicious sample from the [calibration corpus](benchmark/)
		modeled on the 2024 `@solana/web3.js` compromise.
		[▶ Watch the 60-second walkthrough](#screenshots) ·
		[how these were made](docs/demo/README.md)</sub>

		</div>
		@@ -57,11 +63,6 @@
		promotes it when policy allows. It never runs `npm install`, lifecycle
		scripts, build steps, or package code.
		scripts, build steps, or package code. The hero recording above shows both
		sides of that flow — `express` clearing, and a trojaned package blocked with
		the HIGH finding citing the exact wallet-read + exfiltration code.

		<img src="docs/screenshots/cli-guard-block.png" alt="pkgxray guard blocking a malicious sample: BLOCK verdict, grade F, HIGH credential-access finding citing a wallet read exfiltrated to an attacker endpoint, exit code 2" width="820">

		<sub>`guard` blocking a malicious sample from the [calibration corpus](benchmark/)
		(modeled on the 2024 `@solana/web3.js` compromise) — the HIGH finding cites the
		exact wallet-read + exfiltration code. Real run; see
		[how each screenshot was made](docs/screenshots/README.md).</sub>

		## Why pkgxray?
		@@ -296,7 +297,12 @@
		All captures are real runs — reproduction steps for each are in
		[`docs/screenshots/`](docs/screenshots/README.md).
		[`docs/screenshots/`](docs/screenshots/README.md). The CLI `guard` flow is
		shown live in the hero recording at the top of this README, and the full
		60-second walkthrough — the SAFE run, the blocked trojan with its exit code,
		then a lockfile audit — plays right here:

		CLI — `pkgxray guard` clearing `express`, with the npm↔GitHub cross-check
		https://github.com/user-attachments/assets/b5a323b1-a9ec-4676-9601-1b284df81b6b

		<img src="docs/screenshots/cli-guard-safe.png" alt="pkgxray guard on express@4.21.0: SAFE verdict, grade A+, npm tarball matches the linked GitHub repo, per-parameter grades" width="820">
		<sub>Same recording as [`docs/demo/pkgxray-demo.mp4`](docs/demo/pkgxray-demo.mp4)
		(the committed source of truth), rehosted as a GitHub attachment so it plays
		inline. [How it was made](docs/demo/README.md).</sub>

		@@ -303,0 +309,0 @@ MCP proxy — a live session against a malicious demo server

pkgxray - npm Package Compare versions

New alerts

Fixed alerts

Improved metrics