The problem
You review one thing and install another
When you run npm install, you get a tarball uploaded by whoever holds the publish token, not the GitHub code people review. The xz-utils backdoor (2024) and the Shai-Hulud npm worm (2025) both lived only in what was published. IntAnalyze downloads the published package and the source at the exact release commit, compares every file, and gives each one a verdict with evidence.
| File in the package | Verdict | Why |
|---|---|---|
dist/index.js | EXPECTED | Compiled from src/index.ts |
package.json | SUSPICIOUS | New postinstall script not in the source |
lib/x.min.js | SUSPICIOUS | Obfuscated file found nowhere in the repo |
How it works
Seven steps, and the AI never decides
1–2
Resolve and fetch
npm metadata, sha512 check, shallow clone at the release commit.
3–4
Extract and diff
Hardened extraction, then SHA-256 for every file.
5
Classify
11 deterministic rules give each file a verdict and evidence.
6
Explain
Qwen3.5 9B, running locally, writes plain English. Optional.
7
Report
Score 0–100, report, and exit code 0 / 1 / 2 for CI.
Package code is never executed: no install, no scripts, no import or eval.
Reports from real runs
Open a report
Each link is a full HTML report produced by IntAnalyze itself.
Examples, explained by the local model
Committed runs from a team laptop with LM Studio serving Qwen3.5 9B.
| Example | Package | Status | Score | Flagged | Explained by |
|---|---|---|---|---|---|
| clean-fixture | tiny-percent@1.0.0 | CLEAN | 0 | 0 | qwen/qwen3.5-9b (local) |
| malicious-fixture | tiny-percent@1.0.0 | DANGEROUS | 100 | 3 | qwen/qwen3.5-9b (local) |
| real-package | ms@2.1.3 | CLEAN | 0 | 0 | qwen/qwen3.5-9b (local) |
Live checks of real npm packages
Re-run against the npm registry and GitHub every time this site is built (2026-11-01 00:29 UTC). Rules only: the build server has no local model.
| Package | Status | Score | Files | Flagged |
|---|---|---|---|---|
ms@2.1.3 | CLEAN | 0 | 4 | 0 |
react@18.3.1 | REVIEW | 14 | 20 | 3 |
date-fns@4.1.0 | CLEAN | 0 | 5326 | 0 |
Try it
Install and run
git clone https://github.com/sharath-013/IntAnalyzer.git cd IntAnalyzer python3 -m venv .venv && source .venv/bin/activate pip install -e . intanalyze check ms@2.1.3 --no-llm
Optional AI explanations: install LM Studio, run lms server start and lms load qwen/qwen3.5-9b, then intanalyze doctor. Details and every rule are in the README and the code walkthrough.
Limitations
What it can’t do yet
- Checks npm packages only, and needs a source repo it can clone over HTTPS.
- Detection is pattern-based, so clever obfuscation can slip past.
- Build output is matched by file paths, not rebuilt, so heavily bundled packages (for example react-dom) still need a human review.
- This page is static: live checks run when the site is built, not on demand.