NpmGuard

NpmGuard is a supply-chain security gate for npm packages. Developers install packages through the npmguard CLI instead of running npm install directly. If a package already has a SAFE verdict, installation proceeds immediately. If it is DANGEROUS, NpmGuard warns the user and blocks by default. If no audit exists yet, the user can pay for a new audit by Stripe or WalletConnect, then watch the audit stream live. The core system resolves a package version, inspects the package, raises concrete suspicions, executes experiments inside a Docker sandbox, records evidence, and publishes a final SAFE or DANGEROUS report through an API and web dashboard.

NpmGuard is built as a multi-part system. The CLI is TypeScript and detects npm, pnpm, or yarn from lockfiles before running the right install command. The backend is a Python FastAPI engine using Pydantic, SQLAlchemy, durable SSE event logs, LLM-based triage, and Docker sandbox execution. Reports are stored as versioned JSON files under data/reports. Payments are handled server-side through Stripe or an on-chain Base Sepolia flow: the CLI uses WalletConnect and viem, while the engine verifies receipts before starting audits. The frontend is a React + Vite + Tailwind dashboard that shows live audit progress and reports. The smart contract is Solidity, tested and deployed with Foundry.