A CLI tool that scans a JavaScript project for npm v12 install script breakage and generates a risk-annotated allowlist before July 2026
npm v12 (shipping July 2026) disables all package install scripts by default, silently breaking any project that uses native-build packages such as sharp, bcrypt, canvas, sqlite3, fsevents, or bufferutil that rely on node-gyp. Developers must audit every transitive dependency for script usage, risk-score each one against supply chain attack history (the Miasma worm of June 1, 2026 exploited exactly this vector on Red Hat npm packages), and commit a verified allowlist to package.json before July. No existing tool combines dep-tree scanning, risk scoring from known-compromised package history, and allowlist generation in a single workflow. The migration is manual today and CI pipelines will fail silently on upgrade.
A CLI tool that scans a project dependency tree for npm v12 breaking-change exposure and outputs a prioritized migration plan
1.9k ▲Score Breakdown
Social Proof 2 sources
Gap Assessment
lavamoat/allow-scripts generates an allowlist but has no risk scoring or supply chain history. Socket.dev and Snyk scan for malware but do not produce npm v12 allowlists or migration-ready CI patches. pnpm has its own allowlist mechanism but npm users cannot use it. The specific combination of dep-tree scanning plus historical compromise risk scoring plus npm v12 allowlist output plus CI patch is not covered by any single tool.