Crowsnest.

A lookout for what you install.

Nib watches the packages coming aboard your project and rings the bell when one looks wrong.

Install Crowsnest

Free and open source (Apache-2.0) · runs on your machine · no account.

Tap a mark. I'll tell you what I see.

Sample project

These are made-up packages, shown to explain the idea.

How it protects you.

The night the quikrequest came aboard.

  1. You add a package. It joins the line.

  2. One crate is wearing a very familiar name.

  3. I check its age, its users, and how familiar its name looks.

  4. Hold. Not this one.

  5. The rest come aboard. This one waits for you.

A five-panel drawing about a made-up package. Panel 1: a small crow named Nib sits on a masthead with a lit lantern. Three wooden crates queue at the rail, labelled tidy-dates, fast-csv-lite and one new crate; the caption reads "You add a package. It joins the line." Panel 2: close on two crates. One carries a crown and is the famous package. The next, labelled quikrequest, stands one step behind it wearing a fake moustache; the caption reads "One crate is wearing a very familiar name." Panel 3: Nib raises a spyglass. A round inset shows the crate's tag with three marks: new, almost nobody uses it, and a name a hair from a famous one; the caption reads "I check its age, its users, and how familiar its name looks." Panel 4: Nib pulls a bell cord. The bell swings and a three-notch gauge in the corner shows Hold; the caption reads "Hold. Not this one." Panel 5: the quikrequest crate sits on the dock with a tag tied to it while the other crates are loaded, and Nib is back on the perch; the caption reads "The rest come aboard. This one waits for you."

Made-up packages, drawn to explain the idea.

In your terminal, in VS Code, in Slack, and on a dashboard.

Crowsnest flags a package; you decide what to do. The install check runs when you install through Crowsnest. A scan reads the lockfile you already have.

Clear means nothing was found. Hold means stop and look.

Check a name.

Pick a sample package and see how Crowsnest would call it.

Sample data, not real packages.

Sample package

Hold. Not this one.
Hold

quikrequest is six days old, almost nobody downloads it, and its name is very close to a popular package.

What to do. Do not install it. Check that you typed the name you meant.

Why

  • It was registered very recently.
  • Almost nobody downloads it.
  • Its name is very close to a popular package.

Real checks also read the registry and threat lists. Without keys Crowsnest uses cached data.

The sample uses four of the signals Crowsnest checks. It never sends anything anywhere.

Install Crowsnest.

You need Docker. Three commands start Crowsnest on your machine.

  1. Get the code

    git clone https://github.com/devampatel03/Crowsnest.git && cd Crowsnest

  2. Create your settings file

    cp .env.example .env

  3. Start it

    docker compose -f infra/docker-compose.yml up --build

Open http://localhost:3000. API keys are optional.

On Windows Command Prompt, use copy .env.example .env.

Version 0.1.0 is early. A first scan on a fresh install can fail when no API keys are set. Troubleshooting has the details.

Other ways to install

No sign-up. No key. Stop it any time with docker compose -f infra/docker-compose.yml down.

Questions.

Nib's tip: commit your lockfile.

Read the docsInstall Crowsnest