guard-install now scans GitHub repos before you run them

Nithin D J — Mon, 04 May 2026 04:20:34 +0000

Hey everyone,

I shared this earlier as a CLI to analyse npm packages before installing.

Since then, I’ve added something I think is even more useful:

👉 You can now scan GitHub repos before cloning or running them

npx guard-install --repo https://github.com/user/repo

Why this matters

There’s a growing pattern (especially in crypto interviews / side projects):

“Clone this repo and run it locally”

Some of these repos:

access environment variables
interact with wallets / keys
make outbound network calls

You don’t always notice what’s happening before you run the code.

What the repo scan does

Scans files (without executing anything)
Detects:
- sensitive data patterns (PRIVATE_KEY, MNEMONIC)
- crypto/wallet usage
- network calls
- shell execution
Combines signals → gives a risk level (LOW / MEDIUM / HIGH)
Explains why something might need review

Example

🔐 Sensitive data patterns found
💰 Cryptocurrency functionality
🌐 Network activity detected

Risk: MEDIUM — Sensitive domain with multiple relevant signals

Links

GitHub: https://github.com/dasanakudigenithin/guard-install
npm: https://www.npmjs.com/package/guard-install
DEV.to: https://dev.to/nithindj192/npm-installs-packages-blindly-i-built-a-cli-to-fix-that-1dd

Still early, but getting more practical now.

Would love feedback on:

Are these signals useful or noisy?
What would make you trust a HIGH risk warning?
Would you use this before running unknown repos?

Thanks!

npm installs packages blindly — I built a CLI to fix that

Nithin D J — Sat, 02 May 2026 03:20:27 +0000

Hey everyone,

I recently built a small CLI tool called guard-install that analyzes npm packages for potential risks before installing them.

👉 Try it:

npx guard-install axios

The idea came from noticing how npm installs packages blindly, even though supply chain attacks and malicious packages are becoming more common.

What it does:

Checks package metadata (publish recency, maintainers, downloads)
Detects install scripts (postinstall / preinstall)
Scans dependencies (depth-limited)
Calculates a risk score (LOW / MEDIUM / HIGH)
Explains why a package might be risky
Installs safely using --ignore-scripts

Example output:

(you can paste a short CLI output snippet here)

GitHub: https://github.com/dasanakudigenithin/guard-install

npm: https://www.npmjs.com/package/guard-install

This is still early (v0.1.1), so I’d really appreciate feedback:

Is this useful?
What signals would you trust more?
What would make you actually use this daily?