I counted the strangers inside famous npm dependency trees

Описание и применение

Разработчики не видят, какие аккаунты npm имеют права публикации в их зависимостях, создавая скрытую поверхность атаки. CLI‑инструмент dep‑census анализирует package-lock.json и выводит количество таких аккаунтов.

Задача

Developers cannot see which npm accounts have publish rights in their dependency trees, exposing a hidden attack surface.

Результат

On popular repositories, the number of strangers (accounts with publish rights) often exceeds the number of packages, with a single account controlling a significant share of the tree.

Рабочий процесс

• Run npx dep-census <path-to-package-lock.json> or npx dep-census owner/repo
• The tool parses the lockfile
• It counts every npm account with publish rights
• It outputs a table of accounts and their share of the tree

Доказательства

I built a zero-dependency CLI that reads package-lock.json and counts every npm account with publish rights in your tree.

Источник

Insomnia's tree has more strangers than packages: 1,786 people can ship code into an app that stores your API keys.

Источник

Roughly 55% of packages in every tree I checked are maintained by exactly one account.

Источник