Crowsnest.

A lookout for what you install.

Nib watches the packages coming aboard your project and rings the bell when one looks wrong.

Install Crowsnest

Free and open source (Apache-2.0) · runs on your machine · no account.

Tap a mark. I'll tell you what I see.

Sample project

These are made-up packages, shown to explain the idea.

How it protects you.

The night the quikrequest came aboard.

  1. You add a package. It joins the line.

  2. One crate is wearing a very familiar name.

  3. I check its age, its users, and how familiar its name looks.

  4. Hold. Not this one.

  5. The rest come aboard. This one waits for you.

A five-panel drawing about a made-up package. Panel 1: a small crow named Nib sits on a masthead with a lit lantern. Three wooden crates queue at the rail, labelled tidy-dates, fast-csv-lite and one new crate; the caption reads "You add a package. It joins the line." Panel 2: close on two crates. One carries a crown and is the famous package. The next, labelled quikrequest, stands one step behind it wearing a fake moustache; the caption reads "One crate is wearing a very familiar name." Panel 3: Nib raises a spyglass. A round inset shows the crate's tag with three marks: new, almost nobody uses it, and a name a hair from a famous one; the caption reads "I check its age, its users, and how familiar its name looks." Panel 4: Nib pulls a bell cord. The bell swings and a three-notch gauge in the corner shows Hold; the caption reads "Hold. Not this one." Panel 5: the quikrequest crate sits on the dock with a tag tied to it while the other crates are loaded, and Nib is back on the perch; the caption reads "The rest come aboard. This one waits for you."

Made-up packages, drawn to explain the idea.

Where it runs

What the calls mean

Clear means nothing was found. Hold means stop and look. Crowsnest flags a package; you decide what to do. The install check runs when you install through Crowsnest. A scan reads the lockfile you already have.

Check a name.

Pick a sample package and see how Crowsnest would call it.

Sample data, not real packages.

Sample package

Hold. Not this one.
Hold

quikrequest is six days old, almost nobody downloads it, and its name is very close to a popular package.

Do not install it. Check that you typed the name you meant.

Why

  • It was registered very recently.
  • Almost nobody downloads it.
  • Its name is very close to a popular package.

Real checks also read the registry and threat lists. Without keys Crowsnest uses cached data.

The sample uses four of the signals Crowsnest checks. It never sends anything anywhere.

Install Crowsnest.

Pick the way you work. Every way runs on your machine, and none needs an account or a key.

The dashboard

The whole picture in a browser: what needs you now, who publishes your packages, every call made.

  1. git clone https://github.com/devampatel03/Crowsnest.git && cd Crowsnest
  2. docker compose up

Needs Docker and Git. Allow a few minutes the first time (a 430 MB download), then open http://localhost:3000. Dashboard guide.

The terminal

Scan a project, check a package, vet a pull request, stop a risky install.

  1. npm install -g @crowsnest/cli
  2. crowsnest start
  3. crowsnest scan .

Needs Node.js 20 or newer and Docker. The first start downloads about 430 MB. Command line guide.

VS Code

A mark on the import line of a risky package, with the reason on hover.

  1. code --install-extension crowsnest.crowsnest-vscode

Needs VS Code 1.85 and the terminal setup running. VS Code guide.

Version 0.1.3 is early, and the API may change between minor versions. Troubleshooting has the details. Other ways to install or slack guide.

Questions.

Nib's tip: commit your lockfile.

Read the docsInstall Crowsnest