Original Summary

I've been working on capsurface, an open-source tool for reviewing npm dependency updates. Here's the example in the repo: a package update keeps the same public API but adds a postinstall script. capsurface compares the source scan with a saved baseline and shows the new indicators, with file locations. https://github.com/VictorMartins3/capsurface It looks for things like filesystem access, network calls, process execution and credential access. The scan runs offline without executing the packages. You can look through the demo and its source in the browser. No need to install an unfamiliar dependency to decide whether you'd trust my dependency tool. It's an early release. It won't tell you that a package is safe or malicious, and static analysis has limits. I'm trying to make the report useful enough that someone reviewing an update knows where to look next. I'd like feedback on the example: can you tell what changed and why it was flagged?   submitted by   /u/Several-Employ7370 [link]   [comments]

  • 情报分类：商业与市场研究
  • 分类依据：内容涉及商业、投资或市场动态
  • 信息来源：Reddit · SideProject
  • 发布时间：2026/9/23 01:46:01