Every npm install pulls code you did not write. Dependencies nest inside dependencies. A single typo in a popular name, a postinstall script, or a dormant package can compromise your machine — long before CVE databases catch up.
Seerpack lives in VS Code and reads your workspace the way a security reviewer would: package identity, dependency depth, scripts, maintainer signals, and known-bad patterns. You get a 0–100 trust score per package so you can decide what stays in your tree.
The npm Supply Chain Is a Soft Target
Registries move fast. Attackers register lookalike names, hijack maintainers, or slip malware into install scripts. npm audit is essential — but it is not a substitute for understanding who you are trusting and how deep the graph goes.
preinstall / postinstall run with your user privileges during CI and local dev.How Seerpack Scores a Package
Seerpack combines static signals from your manifest and lockfile with heuristics tuned for npm — not a generic “vuln count,” but a weighted view of trust you can act on in the editor.
preinstall, postinstall, and other high-risk hooks.See a workspace scan
This simulates Seerpack’s terminal output. The real extension runs against your package.json and lockfile in the active workspace.
What the 0–100 score means
| Score | Band | Meaning |
|---|---|---|
| 80–100 | Healthy | Strong signals; typical for well-known, well-maintained packages. |
| 60–79 | Review | One or more caution flags — verify before adding to production. |
| 40–59 | Elevated | Serious concerns: scripts, similarity, or depth issues warrant action. |
| 0–39 | Critical | Treat as untrusted until proven otherwise; remove or replace. |
How Seerpack fits your workflow
| Capability | npm audit | Manual review | Seerpack |
|---|---|---|---|
| Editor-native trust view | — | — | ✓ |
| Typosquat / identity heuristics | — | ✓ | ✓ |
| Install-script risk surfacing | — | ✓ | ✓ |
| 0–100 score per package | — | — | ✓ |
| Known CVE / advisory signals | ✓ | ✓ | ✓ |
What you get in VS Code
Example: what Seerpack reads
A minimal manifest is enough to start resolving the tree — Seerpack layers signals on top of what npm installs.
Questions
No. It complements audit and lockfile discipline with trust-oriented signals — typosquats, scripts, depth — that audit alone does not cover.
Seerpack is built local-first. See the Seerpack privacy policy and the extension details on the Marketplace for the exact posture and any optional telemetry.
npm, pnpm, and Yarn-style trees are the target; the extension page lists current lockfile support per release.
Any JavaScript or TypeScript workspace that uses npm dependencies can benefit — internal monorepos included.