Every npm install pulls code you did not write. Dependencies nest inside dependencies. A single typo in a popular name, a postinstall script, or a dormant package can compromise your machine — long before CVE databases catch up.
Seerpack lives in VS Code and reads your workspace the way a security reviewer would: package identity, dependency depth, scripts, maintainer signals, and known-bad patterns. You get a 0–100 trust score per package so you can decide what stays in your tree.
The npm Supply Chain Is a Soft Target
Registries move fast. Attackers register lookalike names, hijack maintainers, or slip malware into install scripts. npm audit is essential — but it is not a substitute for understanding who you are trusting and how deep the graph goes.
preinstall / postinstall run with your user privileges during CI and local dev.How Seerpack Scores a Package
Seerpack combines static signals from your manifest and lockfile with heuristics tuned for npm — not a generic “vuln count,” but a weighted view of trust you can act on in the editor.
preinstall, postinstall, and other high-risk hooks.See a workspace scan
Use the interactive demo below to watch Seerpack detect package.json, open the trust dashboard, and review scores. The real extension runs against your lockfile in the active workspace.
What the 0–100 score means
| Score | Band | Meaning |
|---|---|---|
| 80–100 | Healthy | Strong signals; typical for well-known, well-maintained packages. |
| 60–79 | Review | One or more caution flags — verify before adding to production. |
| 40–59 | Elevated | Serious concerns: scripts, similarity, or depth issues warrant action. |
| 0–39 | Critical | Treat as untrusted until proven otherwise; remove or replace. |
How Seerpack fits your workflow
| Capability | npm audit | Manual review | Seerpack |
|---|---|---|---|
| Editor-native trust view | — | — | ✓ |
| Typosquat / identity heuristics | — | ✓ | ✓ |
| Install-script risk surfacing | — | ✓ | ✓ |
| 0–100 score per package | — | — | ✓ |
| Known CVE / advisory signals | ✓ | ✓ | ✓ |
What you get in VS Code
Example: what Seerpack reads
A minimal manifest is enough to start resolving the tree — Seerpack layers signals on top of what npm installs.
Questions
No. It complements audit and lockfile discipline with trust-oriented signals — typosquats, scripts, depth — that audit alone does not cover.
Seerpack is built local-first. See the Seerpack privacy policy and the extension details on the Marketplace for the exact posture and any optional telemetry.
npm, pnpm, and Yarn-style trees are the target; the extension page lists current lockfile support per release.
Any JavaScript or TypeScript workspace that uses npm dependencies can benefit — internal monorepos included.