npm-scan

What it is

npm-scan (@lateos/npm-scan) is a CLI that scans npm packages and lockfiles for behavioral attack patterns, not CVE or version matches. Its README says npm audit and Snyk do not catch these patterns. The README also names Socket in its headline claim. It runs locally, with no telemetry and no cloud dependency, and claims under 30 seconds per CI run. It has 23 detectors, numbered D1 to D25.

What to do

Try it without installing:

npx @lateos/npm-scan scan axios

Global install and common uses:

npm install -g @lateos/npm-scan
npm-scan axios
npm-scan scan-lockfile
npm-scan express --json > findings.json

CI gate, as given for GitHub Actions. The README says GitLab CI, Jenkins and other platforms also work, and that a GitHub Action and multi-arch Docker images exist:

- name: Scan with npm-scan
  run: |
    npm install -g @lateos/npm-scan
    npm-scan scan-lockfile --fail-on critical

Other outputs and controls: CycloneDX and SPDX SBOMs, SARIF for GitHub Security, and YAML policy-as-code for allowlists and severity overrides.

To report to CISA's VINCE:

npm-scan scan lodash > scan_result.json
npm-scan submit-vince scan_result.json
npm-scan submit-vince scan_result.json --auto-approve

The second command starts the review step. The third submits after approval.

Caveats

• The README calls the review mandatory, yet documents --auto-approve. Keep that flag out of automation so a human still reviews each submission.
• Figures such as "95%+ confidence on real campaigns" and the IronWorm, Miasma and Dependency Confusion validation are the vendor's own claims. The page gives no methodology, false-positive rate or test set.
• The page says "23 detectors" but numbers them D1 to D25, so two numbers are unaccounted for.
• Pricing is inconsistent. The README quotes "$2.4K/year enterprise" in its ROI argument and "$799/yr to $9,900/yr" in the licensing section. Its "1,875x ROI" compares that price with an average breach cost.
• Licensing: free under MIT for individuals, open-source projects and evaluation, with no time limit. A paid BLA is required once a team ships to production commercially. LICENSING.md has the details.
• The page advises running npm-scan alongside npm audit, not instead of it.