install-scripts

Fail CI when dependency changes look suspicious: new install scripts, publisher/maintainer changes, freshly published versions, typosquats, deprecated packages, integrity swaps and git/URL deps. Diffs package-lock, pnpm and yarn lockfiles against a git ref or baseline. Text, JSON, SARIF; GitHub Action included.

See what an install script actually does before you approve it: behavioral analysis, binding.gyp inspection and resolved provenance identity for npm 12 allowScripts, pnpm allowBuilds, yarn and bun

Get DeepSeek Harness talking to Figma — create, edit and read designs from your agent. Working config, install scripts, and the dead ends documented.

See what an npm lifecycle script actually did: files touched, processes spawned, network endpoints contacted. Linux + strace.

A patch bump that starts spawning shells looks exactly like one that fixes a typo. Diffs what a version changed about what a package can do: install scripts, capabilities, hosts, publisher. Nothing runs, nothing lands on disk, zero dependencies.