E-NPM
npm
Inspect Node package manifests, scripts, and lockfiles without installing the app.
OVERVIEW
npm (docs.npmjs.com/cli) is the default CLI for the Node package registry. During a review the useful parts are the ones that do not install anything: `npm ls` prints the tree from an existing lockfile, `npm pkg get scripts` shows lifecycle hooks, and `npm audit` compares the lockfile against known advisories.
`npm install` is a different operation. Lifecycle scripts (`preinstall`, `install`, `postinstall`) run as the current user, which is why an untrusted package.json is a code-execution finding waiting to happen. Inspect the manifest first; if you must install, use `--ignore-scripts` in an isolated environment and treat the result as untrusted code.
USE CASES
Practical use cases
- 01
Listing the dependency tree from a lockfile without downloading packages.
- 02
Reading install and start scripts in package.json for unexpected commands.
- 03
Running npm audit against a scoped lockfile to flag known vulnerable versions.
- 04
Comparing a private package name against the public registry as a confusion lead.
QUICK START
When you have a package.json or lockfile in scope and need the dependency tree and install scripts before touching node_modules.
- Work from a copy of the manifest and lockfile, not a live production checkout.
- Print the scripts block and the dependency tree before any install.
- If an install is required, use an isolated machine and --ignore-scripts.
- Record any unexpected lifecycle command or unaudited private package name.
npm pkg get scripts && npm ls --all --omit=dev --package-lock-onlyBEFORE YOU RUN IT
What to check before running it
npm install executes lifecycle scripts from every package in the tree unless you pass --ignore-scripts — treat an untrusted install as running unknown code.
npm audit only knows published CVE/advisory data; a malicious but unflagged package will not show up.
Registry traffic from npm view/install leaves your IP and token (if any) with the registry — use a throwaway token and stay inside the agreed accounts.