
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Automatically detect tech stacks from repositories and generate logos, JSON, and markdown for portfolios.
Automatically detect the tech stack of any project and generate structured output (JSON, Markdown, or badges).
Designed for portfolios, READMEs, dashboards, and CI automation.
StackScan scans a repository (dependencies + file structure), normalizes detected technologies into categories, and maps them to logos with sensible fallbacks.
package.jsonnpx stackscan@latest
npm install -g stackscan
stackscan
public/stackscan/.package.json file.npx stackscan scan
You can also add a project from anywhere on your disk using the CLI. You can point to a package.json file OR a project directory:
# Point to a file
npx stackscan add ./path/to/package.json
# Point to a folder (automatically finds package.json)
npx stackscan add ../my-project
This will copy the package.json into a new folder inside public/stackscan/ (e.g., public/stackscan/my-project/), handling name collisions automatically.
This will:
public/stackscan/.stack.json and stack.md inside each project folder.public/assets/logos/.README.md with a "My Projects" section.# Use white logos
npx stackscan scan --color white
# Use black logos
npx stackscan scan --color black
# Use brand colors (default)
npx stackscan scan --color brand
When hosting package.json files for analysis, security tools like Dependabot may incorrectly flag them as vulnerable dependencies of your project.
To prevent this, StackScan will automatically rename any package.json found in public/stackscan/ to _package.json.
_package.json._package.json on future runs.For each project in public/stackscan/, a stack.json is generated in the same folder.
Example stack.json:
[
{
"name": "TypeScript",
"slug": "typescript",
"logo": "https://raw.githubusercontent.com/benjamindotdev/stackscan/main/public/assets/logos/language/typescript.svg",
"relativePath": "public/assets/logos/language/typescript.svg",
"color": "#3178C6"
},
{
"name": "Next.js",
"slug": "next",
"logo": "https://raw.githubusercontent.com/benjamindotdev/stackscan/main/public/assets/logos/frameworks/nextjs.svg",
"relativePath": "public/assets/logos/frameworks/nextjs.svg",
"color": "#000000"
}
]
Anything without a known logo still renders cleanly using category defaults (e.g. a lock icon for auth).
StackScan resolves logos in the following order:
next-auth → Auth.js)This guarantees usable output even when a logo is missing.
Use StackScan in CI to keep stack metadata up to date:
name: stackscan
on:
push:
branches: [ main ]
jobs:
stackscan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 20
- run: npx stackscan scan
This keeps it fast, safe, and CI-friendly.
Contributions are welcome — especially:
See CONTRIBUTING.md for development workflow and guidelines.
Special thanks to these amazing icon libraries that make StackScan possible:
MIT
FAQs
Automatically detect tech stacks from repositories and generate logos, JSON, and markdown for portfolios.
The npm package stackscan receives a total of 1 weekly downloads. As such, stackscan popularity was classified as not popular.
We found that stackscan demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.