ShadowNPM

@fozagtx·fawuzan·15 followers·added 2026-07-19

ShadowNPM is an autonomous npm supply-chain security auditor. A Hono/TypeScript engine (engine/src/pipeline.ts) runs packages through six phases — resolve, inventory, triage, investigate, test-gen, verify — with an agentic investigation loop in engine/src/investigation/ that hands the LLM read and execute tools. Generated exploit tests run in a native child-process sandbox (engine/src/sandbox/), backed by a standalone harness and malicious test fixtures under sandbox/. Each audit costs $0.001 USDC settled on Arc: engine/src/index.ts verifies the on-chain USDC transfer with replay protection and a one-time token before unlocking the audit stream. A Vite/React frontend renders verdicts as they arrive.