npm installs packages blindly — I built a CLI to fix that

Source: Dev.to

Introduction

I recently built a small CLI tool called guard‑install that analyzes npm packages for potential risks before installing them.

npx guard-install axios

The idea came from noticing how npm installs packages blindly, even though supply‑chain attacks and malicious packages are becoming more common.

What It Does

• Checks package metadata (publish recency, maintainers, downloads)
• Detects install scripts (postinstall / preinstall)
• Scans dependencies (depth‑limited)
• Calculates a risk score (LOW / MEDIUM / HIGH)
• Explains why a package might be risky
• Installs safely using --ignore-scripts

Example Output

Package: axios
Risk score: LOW
Maintainers: 3
Recent publish: 2 weeks ago
Install scripts: none
Dependencies scanned: 5 (depth 2)
Recommendation: safe to install

(Replace the snippet above with the actual CLI output you see.)

Links

• GitHub:
• npm:

Call for Feedback

This is still early (v0.1.1), so I’d really appreciate feedback:

• Is this useful?
• What signals would you trust more?
• What would make you actually use this daily?

Thanks!