#npm-security

Sandboxing npm install: A new tool puts a denominator under 'npm install runs arbitrary code'

A new tool runs an npm package's install scripts in a sandbox and returns a signed verdict — a useful, if bounded, addition to the supply-chain security toolbox.