npm-sentinel Overview

npm-sentinel is a CLI tool for supply-chain security: it performs behavioral analysis and integrity verification on npm packages before they land in your project, surfacing risky dependencies, tampered tarballs, and low-trust maintainers.

Key Capabilities

• Integrity verification: Fetches package metadata and tarballs directly (via npm-registry-fetch + tar) and validates them against a .sentinel-lock.json, catching tampered or mismatched artifacts.
• Tiered analysis on the install command:
  • Default — fast, shallow analysis of top-level packages.
  • --fast — integrity check only.
  • --deep — full transitive dependency analysis via a queue-based crawler, with live progress indicators.
• Trust scoring: The check command renders a dashboard scoring a package and flagging Concerns — brand-new packages, single-maintainer packages, and heavy direct-dependency counts — plus suggested Alternatives.
• Policy engine: Enforce org rules through a .sentinelrc.js config, with a --ci mode that fails builds on policy violations.
• Resilient by design: Exponential backoff on registry 429 rate limits, plus caching of download counts and trust-score results to minimize API calls.

Usage

# Analyze before installing (shallow, fast by default)
npm-sentinel install express
 
# Integrity check only
npm-sentinel install express --fast
 
# Full transitive analysis
npm-sentinel install express --deep
 
# Inspect a single package's trust dashboard
npm-sentinel check lodash

Tech Stack

Where It Fits

npm-sentinel is the supply-chain counterpart to ApiShield: where ApiShield hardens the runtime edge of an app, npm-sentinel hardens what you pull into it in the first place.