GitHub - ai/multiocular: ꙮ Review dependencies changes to prevent supply chain attack

A Node.js tool to review dependencies changes to:

• Prevent supply chain attack.
• Catch API breaking changes.
• Learn from your dependencies.

In general, it adds open dependencies practice to your project and stop treating node_modules as a black box.

It supports: npm, pnpm, yarn 1, yarn berry, GitHub Actions.

  Multiocular is built by Evil Martians, an American design and engineering consultancy for developer tools, AI, and cybersecurity startups.

Usage

Install Multiocular:

npm install multiocular
# pnpm install multiocular

Update dependencies

# For npm
npx npm-check-updates
npm update

# For pnpm
pnpm update-interactive --latest
pnpm update

# For GitHub Actions
npx actions-up

Start web UI to review changes:

If you have GitHub API limit, define GITHUB_TOKEN environment variable with personal token with access to public repositories.

Motivation

Current practice of treating dependencies and free black boxes is creating a lot of issues in our industries.

For instance, Supply chain attack when malware added to dependencies by stealing maintainer account. Recent, chalk/debug, nx, and GitHub Actions examples are showing that it is just beginning.

We suggest another open dependencies model, when team should track dependencies. It means less dependencies and more attention to it. But this is the only solution we see.