Know what you build with
Inspect package behavior
Review maintainers, release history, source, permissions, install scripts, native binaries, and network behavior before trusting a dependency.
8 minute lesson
A package name and download count are not a security review. Look at what the package can do during install and runtime.
Check repository ownership, maintainer changes, recent releases, unresolved security reports, bundled code, lifecycle scripts, and published files. A tiny convenience package with broad install-time authority may cost more risk than a few local lines.
npm pack kleur --dry-run
npm view kleur scripts dist.integrity repositoryA color-formatting package looks harmless at runtime but defines a postinstall script. During CI installation, that script can read environment variables and make network requests with the job token still present.
Registry popularity cannot reveal that authority. Inspect the exact published archive because repository source and packaged files can differ.
Inspect the published files, lifecycle scripts, maintainers, repository link, and integrity metadata for one real dependency. Save the command output and name every install-time capability you find. Then test the review method on a package with a lifecycle script or bundled native binary.
Lesson completed