trace-npm

npm now asks you to approve install scripts. Nothing tells you what they do.

Human

trace-npm runs one lifecycle script under a syscall tracer and reports what it read, what it spawned and what it contacted — including, in its demonstration capture, the planted credential that took the bait.

npx trace-npm run --package suspect --script postinstall

Evidence, not verdicts: the output is a record of observed behaviour with its blind spots attached.

Technical

The instrument executes the target script inside a controlled environment while a syscall tracer records filesystem reads, process spawns and network endpoints. The resulting trace is normalised into an inspectable report: every touched path, every child process, every contacted host, each with its raw syscall line preserved.

The demonstration capture below replays a recorded run against a package whose postinstall was planted with a credential-harvesting payload. The decoy key is read forty-one milliseconds after the script starts.

Full

Provenance. The package name and publication history are preserved. Originally developed in Sekiya’s Systems & Security area; ownership transferred to Joshua’s personal GitHub profile on 2026-09-15 and it is no longer Sekiya-owned or Sekiya-developed work. This page is kept as a historical reference, not a current Sekiya research listing.

Blind spots. The tracer sees one process tree on one kernel; behaviour gated on environment, time or remote state may not fire during a run. A clean report is an absence of observed behaviour, not evidence of absence.