Scanning packages

deps checks a package for supply-chain risk before you trust it. It uses GuardDog, Datadog's malicious-package detector, and reports in the same format as scan.

malware-detector deps <package-dir-or-archive> [--ecosystem npm|pypi] [options]

The ecosystem is detected automatically: a directory containing package.json is treated as npm, anything else as PyPI. Use --ecosystem to override it.

Vet an npm package

npm pack left-pad                 # downloads left-pad-<version>.tgz, nothing is installed
tar xzf left-pad-*.tgz            # extracts to ./package
malware-detector deps ./package

Vet a PyPI package

pip download --no-deps --no-binary :all: requests -d ./pkgs
malware-detector deps ./pkgs/requests-*.tar.gz --ecosystem pypi

Download, don't install

npm install and pip install can run the package's install scripts, which is exactly the attack you're trying to catch. Use npm pack / pip download to get the files without running anything.

What it catches

GuardDog findings are mapped onto the shared severity scale:

GuardDog signal	Examples	Severity
threat-* (malicious behaviour)	exfiltration, download-and-execute, obfuscated code	CRITICAL
Metadata heuristics	typosquatting, deceptive author, empty description	HIGH
capability-*	network access, process spawning	MEDIUM

deps or scan --include-deps?

	deps	scan --include-deps
Target	one package	your whole project, deps included
Looks at package metadata	✅ (typosquats, authors, …)	❌
Uses the malware rule pack	❌	✅
Best for	"should I add this package?"	"is anything in my tree compromised?"

For the most thorough review of a package you're unsure about, run both:

malware-detector deps ./package
malware-detector scan ./package --include-deps --with-malcontent