Free tools Windows power users keep installed
One-click scans. No signup required.
If a malicious npm package may be in your project, first determine whether it was only listed, installed, executed, or deployed. Stop ongoing builds when execution is plausible, preserve logs, identify the exact package and version, rotate credentials available to the affected process, remove the compromised version, rebuild from a trusted state, and continue monitoring. A package in package.json is a different incident from code that ran with access to CI secrets or production credentials.
Start by determining what actually happened
Do not begin by deleting a directory or running a blanket upgrade. Establish the package name, exact version, source, location, and timeline. The response depends on the highest exposure state you can support with evidence.
As an Amazon Associate I earn from qualifying purchases.
| Exposure state | What it means | Immediate scope |
|---|---|---|
| Manifest entry only | The package appears in package.json or another manifest, but there is no evidence that it was installed or executed. |
Inspect lockfiles and dependency resolution, remove the affected version, and check whether any automated install could have run it. |
| Lockfile or installed files | The version was selected by a lockfile or exists in node_modules, but execution is not confirmed. |
Trace install jobs, lifecycle scripts, local tooling, and any post-install activity. Treat the machine or runner as potentially exposed until logs show otherwise. |
| Executed on a developer machine | A script, build, test, editor integration, or package lifecycle hook ran the code locally. | Investigate credentials, source repositories, SSH agents, cloud tools, and files readable by that user account. |
| Executed in CI | The package ran in a build, test, release, or deployment job. | Pause affected pipelines, preserve runner artifacts and logs, and rotate secrets available to that job. |
| Reached a deployed environment | The package was included in an artifact, container, server, function, or other production target. | Contain the deployment, identify what the process could access, rebuild from a trusted source, and investigate application and infrastructure logs. |
Nested dependencies matter as much as direct dependencies. A package can enter through a framework, plugin, build tool, or test utility even when its name never appears in your top-level manifest.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Identify the package and affected versions
- Record the exact package name, version, registry or tarball URL, integrity information, and the first time it appeared.
- Search every relevant manifest and lockfile, including
package.json,package-lock.json,npm-shrinkwrap.json,yarn.lock, andpnpm-lock.yaml. - Inspect the dependency graph. For npm,
npm ls --allshows installed paths, while
npm explain <package-name>helps identify why a transitive package is present.
- Compare lockfile history and recent commits. Check when the version changed, who or what changed it, and whether an automated update opened or merged the change.
- Review install, build, test, and deployment logs for lifecycle scripts such as
preinstall,install, andpostinstall, as well as commands that invoke package binaries.
GitHub’s security incident response guidance recommends examining malware alerts, code references, dependency graphs, manifests, lockfile history, repository activity, and related security alerts. Its malware alert support currently covers the npm ecosystem; verify the current availability and coverage in your organization’s GitHub documentation.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Contain execution without destroying evidence
If the package may still run, contain first. Pause affected builds, release jobs, scheduled workflows, and deployments. Disable a compromised self-hosted runner or remove it from the runner pool rather than allowing it to process another job. If production execution is plausible, isolate the affected workload according to your operational procedures and preserve the relevant image, package cache, logs, and filesystem evidence before disposal.
- Do not push a hurried “cleanup” commit that overwrites the timeline.
- Save CI logs, runner labels, job definitions, artifact metadata, container digests, and package-manager output.
- Record the machine, runner, environment, user account, and time zone for every suspected execution.
- Restrict access to preserved evidence and calculate checksums if your incident process requires chain-of-custody records.
- Tell contributors not to reinstall or rerun the affected branch until containment instructions are clear.
GitHub describes incident response as “not a linear process.” In practice, you may return to containment after discovering a second execution path or a credential that was missed during the first pass.
Assess credentials exposed to the process
Rotate credentials based on the execution context, not merely on where the package was listed. If the code ran, assume it could read environment variables, configuration files, process arguments, mounted files, credential helpers, and network-accessible metadata that the process could access. A package that was never executed does not automatically justify rotating every credential in the organization, but an executed package with access to a broad CI environment can require an extensive response.
| Execution context | Credentials and access to inventory | Response |
|---|---|---|
| Developer workstation | npm tokens, source-control tokens, SSH keys or agents, cloud CLI credentials, local .env files, signing keys, and browser or credential-helper sessions available to the account. |
Revoke or rotate potentially readable items, review source-control and cloud audit logs, and investigate unusual network or repository activity from the workstation. |
| CI runner | CI/CD variables, repository access tokens, package-publishing tokens, cloud deployment keys, signing credentials, SSH keys, and secrets mounted into the job. | Stop or quarantine the runner, revoke exposed job and deployment credentials, rotate shared secrets, and inspect jobs that used the same runner or secret set. |
| Production workload | Service-account tokens, cloud instance or workload identity permissions, database credentials, API keys, signing material, and secrets mounted into the application. | Contain the workload, revoke or rotate credentials according to the provider’s procedure, review access logs, and redeploy from a verified artifact. |
CISA’s npm alert specifically recommends rotating or revoking credentials that may have been exposed on affected systems or pipelines, including version-control, CI/CD, cloud, npm, and SSH credentials. Revoke before rotating when the platform supports both actions, because a copied token can remain usable until invalidated. Check token-use, authentication, repository, cloud, package-registry, and deployment logs for activity outside the expected time, location, or workflow.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Handle shared and indirect credentials carefully
A secret does not need to be printed in a log to be exposed. If a process could read it, include it in the investigation. Conversely, do not claim that every organizational secret was compromised when the package ran in a sandbox with a narrowly scoped identity. Document which account, role, filesystem, network, and environment variables were actually available, then set rotation scope from that evidence.
Check for persistence and unauthorized changes
Malicious code may attempt to remain useful after the package is removed. Inspect recent repository and infrastructure activity, not just the package directory.
- Review commits, branches, pull requests, tags, release workflows, and changes to protected-branch settings.
- Inspect workflow files for new steps, downloaded executables, altered permissions, encoded scripts, or unexpected outbound destinations.
- Check repository webhooks, deploy keys, installed applications, access tokens, and organization-level integrations.
- Review self-hosted runner registration, labels, startup scripts, services, scheduled tasks, shell profiles, and newly installed binaries.
- Compare deployment manifests, container build files, startup commands, and infrastructure definitions with a known-good revision.
- Look for unexpected package-publish activity, release artifacts, commits, issue comments, or account logins.
Remove unauthorized changes only after preserving their details. Record the commit or configuration identifier, time, author or token, and affected systems so that cleanup does not erase useful evidence.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRemove the compromised dependency and restore a trusted version
Use the package-specific advisory to identify affected versions and the first known-good release. Do not guess that the newest version is safe if the advisory gives a narrower range or requires a particular release.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
- Update the direct dependency declaration, or the parent dependency that brings in a compromised transitive package.
- Regenerate the appropriate lockfile so it no longer selects the affected version. Review the diff rather than accepting unrelated dependency churn.
- For a direct npm dependency, use a deliberately selected version, for example
npm install <package-name>@<known-good-version>Then inspect the resulting manifest and lockfile.
- If the package is transitive, update the responsible parent package or use the package manager’s supported override or resolution mechanism, following the advisory’s compatibility guidance.
- Remove the old installation and caches from the affected environment. On a disposable build workspace, recreate the workspace rather than trusting an existing
node_modulestree. - Install from a trusted registry or approved source, verify package integrity and provenance information available to your organization, and rebuild the artifact.
- Commit the reviewed manifest and lockfile changes through your normal code-review controls.
For a clean, reproducible npm install in CI,
npm ciinstalls from the lockfile and fails when the lockfile and manifest disagree. Run it only after the lockfile has been reviewed and the build environment is trusted. If a runner itself may be compromised, replace or reimage it instead of relying on a clean command inside the same operating system.
Do not treat npm audit as incident proof
npm audit reports dependency security issues; it is not a standalone malware-containment test. A malicious package can be absent from the advisory database, and a clean audit does not prove that a token was not copied or a workflow was not altered. npm documents that npm audit fix runs an install operation under the hood, so do not run it blindly on an environment that may still contain untrusted code or credentials. Use the advisory, dependency graph, lockfile review, execution logs, and rebuild evidence together.
Verify the rebuilt project
Verification should produce evidence that the malicious version is gone and that the resulting artifact came from a trusted path.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Run
npm ls --allor the equivalent package-manager graph command and confirm that no path resolves to the affected package version. - Search all lockfiles, vendored dependency directories, package caches used by the build, and generated bundles for the package name and known indicators from the applicable advisory.
- Build in a newly provisioned or reimaged environment with the rotated secret set, then record the source revision, lockfile hash, artifact digest, and build identity.
- Compare workflow, deployment, and infrastructure files against a trusted revision and remove any unauthorized persistence.
- Confirm that revoked tokens fail and that replacement credentials are scoped to the minimum required permissions.
- Run tests and security checks appropriate to the application, then review outbound network activity and build logs for unexpected commands or destinations.
Do not declare success merely because the package directory disappeared. The verification target is the complete path from source and lockfile to build runner, artifact, deployment, credentials, and repository configuration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Monitor after remediation
Continue monitoring for days and weeks after the immediate fix. Review source-control audit events, token usage, npm and registry activity, cloud access logs, CI job history, runner registrations, webhook deliveries, deployment events, and secret-scanning alerts. Establish a time window around the first possible execution and compare activity before, during, and after it.
Escalate when you find an unknown login, token use from an unexpected location, new repository automation, package publication you did not authorize, unexplained cloud activity, or an artifact whose provenance cannot be demonstrated. Preserve the evidence and involve your security or incident-response function rather than repeatedly reinstalling over the same environment.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesDecision guide for common situations
The package is only in a pull request
Do not merge it. Check whether a contributor or automation changed the lockfile, inspect the proposed package tarball and scripts through your normal review process, and verify that no CI job ran on the branch with privileged secrets. If untrusted pull requests receive secrets, treat any completed job as a possible execution event.
The package is in the lockfile but no run is confirmed
Search CI and developer logs for installs, lifecycle scripts, test commands, and build steps. Remove the affected resolution, regenerate and review the lockfile, then install in a clean environment. Rotate credentials only when the evidence shows they were available to an executed process or when your security policy requires precautionary rotation.
The package ran locally
Disconnect or isolate the workstation as appropriate, preserve logs, identify the user and process context, and rotate credentials readable by that account. Inspect repository activity and cloud logs before returning the machine to development. Reimage when you cannot establish that persistence and unauthorized binaries were removed.
The package ran in CI or production
Pause the affected pipeline or isolate the workload, revoke credentials available to the job or service, preserve runner and deployment evidence, and rebuild from a trusted source. Review every other job, service, or environment that shared the same identity, runner, image, cache, or secret.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Common mistakes that prolong the incident
- Checking only
package.json: transitive dependencies and lockfiles can select the malicious version. - Deleting
node_modulesand stopping there: this does not revoke copied credentials or remove repository persistence. - Rotating only the npm password: the process may have accessed source-control, CI/CD, cloud, SSH, database, or signing credentials.
- Running an automatic fix on the suspect runner: an install operation can execute package scripts in the same environment.
- Reusing a self-hosted runner: filesystem changes or installed executables may survive one job and affect later jobs.
- Assuming “no alert” means “no compromise”: alert coverage and package-specific indicators are incomplete; execution and access evidence still matter.
- Over-rotating without scoping: indiscriminate changes can cause outages and obscure which credentials were actually exposed. Map access first, then rotate decisively.
Keep an incident record
Record the package and versions, affected repositories and environments, first and last possible execution times, dependency paths, commands run, credentials revoked or rotated, unauthorized changes found, clean-build identifiers, and monitoring owners. Include decisions that narrowed or expanded scope and the evidence supporting them. This record lets another responder reproduce the conclusion and helps prevent the same package path, runner, token, or workflow from reintroducing the risk.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
