Security●Mid
Lateos/NPM-scan – open-source NPM supply chain scanner, v0.18.3
NPM supply chain scanner competing against Socket, Snyk, and npm audit.
Ship It
lateos-ai
1012d ago
Back to browse
GitHub Repository
Find out if your system was compromised by the recent axios supply chain attack.
30 starsGo
Scanner to check if you are affected by the axios supply chain attack
by aeneas_ory·Apr 2, 2026·2 points·0 comments
AI Analysis
●●SolidSolve My ProblemShip It
Forensic triage CLI with verdict system for axios IOC detection.
Strengths
- •Three-tier verdict system (CONFIRMED, LIKELY_EXPOSED, NO_EVIDENCE) adds nuance.
- •Cross-platform support with platform-specific IOC paths for each OS.
- •Read-only by design, safe to run on production systems without modification.
Weaknesses
- •Incident-specific tool loses relevance once axios vulnerability is resolved.
- •No Windows executable pre-built, requires Go installation and compilation.
Category
Target Audience
DevOps engineers, security teams, developers auditing npm dependencies
Similar To
npm audit · Snyk · Socket.dev
Similar Projects
Security●●●Banger
Pipguard – pre-install malware scanner for Python supply-chain attacks
Behavioral malware scanning before install, unlike pip-audit.
Solve My Problem
secondmod
202mo ago
Security●●Solid
Pytest tests catching Python supply chain attacks (litellm .pth vector)
Catches .pth injection vectors from the litellm attack when Snyk and Dependabot miss them.
Dark HorseSolve My Problem
qualitymax
202mo ago
Security●●Solid
Script to check if Notepad++ is backdoored by Lotus Blossom APT
Triage tool for a real attack, but static IoC-matching won't catch adaptive threats.
Solve My Problem
10000000001
1113mo ago
Security●●●●Gem
Vett – Scan, sign, and verify AI agent skills before installing
First real supply-chain defense for AI agent ecosystems; catches nation-state-grade payloads.
Zero to OneBig BrainWizardry
nikon
303mo ago
Security●Mid
Pqurp – Quarantine Window for Packages to Prevent Supply Chain Attacks
Speculative protocol for package quarantine without a reference implementation or registry buy-in.
Bold Bet
exec7
501mo ago