Nobody can prove a package is safe, but you can spot most bad ones in five minutes. Check that the name is exactly what you meant, who publishes it, how old and active it is, what install scripts it runs, and whether it has known vulnerabilities. If two of those look odd, stop.
1. Is the name exactly right?
Typosquats rely on a rushed copy and paste. Compare the name letter by letter against the project's own documentation or repository, not a search result or a chat answer. Look for swapped letters, an extra hyphen, or a scope you do not recognise.
2. Who publishes it?
Open the registry page and check the maintainers and the linked repository. Does the repository exist, and does its code match what the package claims to do? A package with no repository link, or a link that points somewhere unrelated, deserves suspicion.
3. How old and how active is it?
A package created last week with a famous sounding name is a warning sign. So is a long dormant package that suddenly ships a new release with a new maintainer. Read the release history. Steady, boring releases are what you want.
4. What runs when you install it?
npm runs lifecycle scripts such as preinstall, install and postinstall after modules are installed. Open the package manifest and read those entries. A script that downloads and runs something, or reads environment variables, does not belong in a small utility.
npm view some-package scripts
npm view some-package repository.url maintainers
5. Does it have known problems?
Run an audit, which sends your dependency description to the registry and reports known vulnerabilities. A clean result only means nothing is known, not that nothing is wrong. Brand new malicious packages often have no advisory yet.
What a pass does and does not mean
Passing these checks lowers your risk. It does not remove it. Treat new dependencies like a new colleague with access to your build machine: a little scrutiny up front, and a way to remove them later.
If you want a second opinion on a project you already have, Safeguard offers a free scan at https://gold.safeguard.sh/scan that reads your dependencies and shows known issues.
Quick check
Does a high download count mean a package is safe?
No. Popularity makes a package a bigger target and makes typosquats of it more likely to be installed by accident. Use downloads as one weak signal among several.
Is a clean audit enough?
No. An audit reports known vulnerabilities only. A freshly published malicious package may not be in any database yet.
Sources
Last reviewed: 19 October 2026.
