Free tools Windows power users keep installed
One-click scans. No signup required.
If you suspect a malicious npm dependency, identify the exact affected package versions, remove the dependency from your manifest and lockfile, then rebuild from the corrected lockfile. Also check whether the package could have run in your development or CI environment. If credentials were accessible during suspicious execution, revoke or rotate them and investigate their use.
1. Confirm the package name and affected versions
Start with the security alert or package advisory. Record the exact package name, which versions are affected, when the dependency entered the project, and whether it is a direct dependency or arrived through another package. Do not assume every release is malicious: use the advisory’s affected-version range to determine whether your project is in scope.
As an Amazon Associate I earn from qualifying purchases.
This distinction matters because removing a package that was never present, or treating all versions as compromised, can lead to unnecessary changes while missing the actual vulnerable dependency. npm asks people reporting malware to provide the package name and all affected versions they know about. See npm’s malware-reporting guidance.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 112. Find every project reference
Check the dependency records and installed tree, not just one directory. In each relevant project and workspace, review package.json, package-lock.json or npm-shrinkwrap.json, and the installed dependency tree. Search your organization’s repositories for the package name, including workspace manifests and lockfiles.
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
- Inspect the dependency graph to see whether the package is direct or transitive and which parent package introduces it.
- Review manifest and lockfile history, recent commits, and pull requests to establish when and how it entered the codebase.
- Check relevant CI workflow files and recent workflow changes, as well as runs and logs from the period when the affected version was present.
GitHub’s supply-chain investigation guidance describes reviewing repositories, dependency history, workflows, and incident activity. Which logs and security features are available depends on your plan, permissions, configuration, and whether the feature was enabled.
3. Remove it from the dependency graph
If it is a direct dependency
From the relevant project directory, run:
npm uninstall <package>
For a dependency in a particular workspace, target that workspace using your project’s npm workspace setup. After the command completes, inspect the changes to the manifest and lockfile. By default, npm uninstall updates package.json and package-lock.json or npm-shrinkwrap.json. See the npm uninstall documentation.
If it is transitive
Identify the parent dependency that brings in the affected package, then update or remove that parent as appropriate. Confirm the affected package no longer appears in the resulting dependency graph and lockfile. Deleting only its directory from node_modules is not a lasting fix: a future installation can restore anything still recorded in the dependency graph.
4. Rebuild from the corrected lockfile
Once you have reviewed and corrected the lockfile, run a clean installation in the project:
Rank #3
npm ci
npm ci requires an existing lockfile, removes the existing node_modules directory, and installs the locked dependencies without rewriting the lockfile. That makes it useful for checking that the corrected dependency records produce a clean installation. It is not a malware scan, and it cannot establish whether the package executed before removal. See the npm ci documentation.
5. Check whether the package could have run
Work out whether the affected version was present during any activity that could execute its code. Consider installation and post-install scripts, build scripts, tests, application runtime, and CI jobs. The fact that a package appears in a lockfile does not by itself establish that its code ran; conversely, deleting it now does not undo execution that may have happened earlier.
- Review local and CI installation, build, and test activity during the affected period.
- Inspect GitHub Actions runs and logs, recent pushes, and changes to workflow files for unexpected activity.
- Review secret-scanning findings and available audit logs for suspicious credential or account use.
- Look for unexpected repository, account, or workflow changes made while the package may have been active.
GitHub warns that supply-chain incidents can involve credential compromise, code injection, and data exfiltration. Its investigation guidance also notes that features and logs depend on plan, role, setup, and configuration; an absence of available logs is not proof that no execution occurred. See GitHub’s incident-investigation guidance and its secret-scanning documentation.
6. Rotate credentials that may have been exposed
If a token, key, or other secret was accessible to suspicious code while the affected package could execute, treat it as compromised. Revoke it or replace it with a new credential, then review activity performed with the old one. Check for unexpected repository, account, and workflow changes, and investigate other use of the affected credential.
Best Value
Prioritize credentials available to the relevant development machine or CI jobs, including credentials stored in CI secrets. A July 28, 2026 GitHub post by Principal Product Security Engineer Greg Ose and Principal Software Engineer Zachary Steindler states: “The number one thing you can do to disrupt these attacks is to remove long-lived credentials from your CI/CD pipeline.” This is general supply-chain guidance; decide which credentials to rotate based on what the suspicious execution could access. See GitHub’s supply-chain security updates.
7. Report suspected npm package malware
Use the package page’s Report malware flow to notify npm Security. Include the package name, all affected versions you know about, and useful evidence such as repository references, commits, or code examples. npm says it validates reports and may remove the package and publish an advisory. See npm’s reporting instructions.
Prevent a repeat without treating alerts as proof
Keep dependency records and CI workflows under review, and make sure your organization knows how to assess alerts across its repositories and workspaces. GitHub reported in September 2025 that it immediately removed more than 500 compromised packages from the npm registry during its response to Shai-Hulud. That figure describes GitHub’s response to that incident, not the number of malicious npm packages overall. See GitHub’s supply-chain security updates.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsGitHub also reported in 2026 that Dependabot version-update pull requests wait until a release has been available for at least three days by default, while security updates continue to open immediately. This cooldown can delay routine version-update pull requests; it is not a guarantee that a package is safe after three days. See GitHub’s Dependabot cooldown announcement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
