Buyer's guide · npm dependency security · Checked
npm package security scanners compared: known CVEs, malware and AI-invented packages
For most JavaScript projects the best first check is free: npm audit, built into npm, reports known vulnerabilities in your dependencies, and GitHub's Dependabot alerts, including malware alerts, are available on every GitHub plan. Known-vulnerability databases can't flag a brand-new malicious package or a package name an AI tool made up, so add a check that looks at the package itself before or during install, such as npq, Aikido Safe Chain or Socket's free plan. Pay for a team plan or a human review when an AI tool added packages you don't recognise and you can't tell which warnings matter.
Disclosure: ChikuOS sells some of the options below, and they're labelled "ChikuOS". No vendor paid to be listed or placed, and we earn no commission or affiliate fee from any link on this page. Prices and features of other products are as listed on their own sites on 18 October 2026; follow the links to check current terms.
npm package security scanners compared (prices as listed by each vendor)
How we chose and ordered these: Free tools that check known vulnerabilities come first, then free tools that check packages before or during install, then platforms with paid plans (lowest listed price first), then our human review. What each tool checks is as its docs describe it; we haven't benchmarked them against each other. How we compare.
| Tool | How it works | Price | What it catches | Keep in mind |
|---|---|---|---|---|
| npm audit | Built into the npm CLI | Free | Known vulnerabilities reported for your dependency tree, with suggested fixes | Only published advisories. A new malicious package usually has none yet |
| GitHub Dependabot alerts | GitHub repository feature | Free on all GitHub plans | Known vulnerabilities, malware alerts for malicious dependencies (on GitHub.com), optional update pull requests | Your code needs to be on GitHub |
| OSV-Scanner | Open-source CLI from Google using the OSV database | Free | Known vulnerabilities across many languages and lockfiles | Known advisories only, like npm audit |
| npq | Open-source CLI (Apache-2.0) you run instead of npm install | Free | Before install: known vulnerabilities, package age, download count, missing README or LICENSE, install scripts | By default it carries on after 15 seconds if there are only warnings; its own docs say it can't guarantee safety |
| Aikido Safe Chain | Free wrapper for npm, npx, yarn, pnpm, bun and pip | Free, no token | Blocks known malware at install time, and blocks packages newer than 48 hours | Install-time protection, not a report on what's already installed |
| Socket | GitHub app, CLI and web reports | Free plan; Team $25 per developer a month | 70+ risk types, including malicious dependencies it can block automatically | The free plan has monthly usage limits |
| Snyk | Dependency, code, IaC and container scanning | Free plan; Team from $25 a month | Known vulnerabilities in dependencies, with IDE, CLI and Git integrations | Free plan has test limits per product |
| Aikido platform | Repo scanning: dependencies, code, secrets | Developer plan free (2 users, 10 repos) | Dependency scanning with reachability, plus code and secrets scanning | Broader than npm; paid plans add more repos and features |
| ChikuOS npm Dependency & Slopsquatting Scan | Human review of your package.json and lockfile | $49, 24 hours | npm audit and Semgrep supply-chain results reviewed by hand, very new, low-download, typo-similar or recently transferred packages, install scripts, abandoned dependencies; ranked list with exact commands | Read-only and one-off. It reduces risk but can't prove a package is safe |
Which one should you pick?
- Every project: run
npm auditand turn on Dependabot alerts if your code is on GitHub. Both are free. - An AI tool installs packages for you: put an install-time check in front of npm, such as npq or Aikido Safe Chain, so a made-up or brand-new package gets a warning before it runs.
- A team shipping every week: Socket, Snyk or Aikido's free plans cover pull requests and CI; their paid plans add more seats, scans and features.
- You've got a long list of warnings and don't know what matters: a one-off human review, such as our $49 npm package scan, turns it into a short list of what to remove, upgrade or replace.
Why AI-written code needs an extra check
Code-writing AI tools sometimes suggest packages that don't exist. A 2024 study, We Have a Package for You!, generated 576,000 code samples with 16 models and found that on average at least 5.2% of suggested packages from commercial models, and 21.7% from open-source models, were hallucinated. If someone registers one of those names, the next person who runs the AI's install command gets their package. This is often called slopsquatting. Tools that only check known vulnerabilities won't flag it, because a new package has no advisory yet. Checks on package age, downloads and install scripts, or a block on very new packages, are what catch it.
What no scanner proves on its own
- That a package is safe. npq's own docs say a malicious package with no public advisory can pass its checks.
- That you need every package. Removing unused dependencies cuts risk more than any scanner. Check what the AI added and whether you use it.
- That a warning matters. Many advisories affect code paths your app never calls. Reachability features (Socket, Aikido) or a human review help sort them.
FAQ
What is the best free npm security scanner?
Start with npm audit, which is built into npm, and GitHub's Dependabot alerts if your code is on GitHub. For malicious or AI-invented packages, add an install-time check such as npq or Aikido Safe Chain, or Socket's free plan.
Does npm audit detect malware?
npm audit reports known vulnerabilities from published advisories. A brand-new malicious package usually has no advisory yet, so pair it with a tool that checks packages before or during install.
What is slopsquatting?
Registering a package under a name that AI coding tools tend to invent, so people who copy the AI's install command get the attacker's package. A 2024 study of 576,000 AI-generated code samples found hallucinated package names were common, especially from open-source models.
How do I check an npm package before installing it?
Look at its age, weekly downloads, maintainers, repository link and install scripts on npmjs.com, or run it through npq, which checks these for you. Be wary of packages published in the last few days with very few downloads.
How much does an npm dependency scan cost?
Free for npm audit, Dependabot, OSV-Scanner, npq and Aikido Safe Chain; Socket's Team plan is $25 per developer a month and Snyk's Team plan starts at $25 a month; our one-off human review is $49, as listed on each vendor's site on 18 October 2026.
How this guide was made: researched and drafted with AI assistance, then every price and claim was checked against the linked source on 18 October 2026. Editorial responsibility: ChikuOS. Spotted something out of date? Email hello@chikuos.com and we'll correct it.