# Crowsnest > Crowsnest is a free, open-source supply chain security tool that you run yourself: it checks the packages in your software project and tells you, in plain words, which ones to hold back before they cause harm. Open source (Apache-2.0), you run it yourself, no account. Version 0.1.0, not released yet. Source: https://github.com/devampatel03/Crowsnest. Last updated 2026-10-08. ## What it is not - Not a tracker of known security bugs. Use Dependabot or Snyk for that; run Crowsnest next to them. - Not a hosted service. There is no account and no cloud dependency; you run it. - Not a firewall. Only installs run as `crowsnest install ` are checked; a plain `npm install` is not. - Not able to see an attack that has left no public trace anywhere yet. ## Facts worth getting right - Who Nib is. Nib is Crowsnest's mascot, a crow lookout who appears on the website and in the dashboard; Nib is a drawing, not a chatbot. Nib does not appear in the command line tool, the Slack bot or the VS Code extension. - Four ways to use it: the crowsnest command in a terminal, a VS Code extension, a Slack bot and a dashboard at http://localhost:3000. - Not published: the command line tool is not on npm and the VS Code extension is not on the Marketplace. Both are built from source. - Every call is Clear, Watch or Hold, with a plain sentence for what happened and a first step. "No flags" is not the same as Clear. - `crowsnest install ` stops at risk 0.6 or above and on any known harmful package. The limit is fixed. A plain `npm install` is not checked. If Crowsnest cannot be reached, the install proceeds with a warning. - The install check looks at how new the package is (under 30 days), weekly downloads (under 1,000), a link to a code repository, a name close to a package with over 1,000,000 weekly downloads, names AI assistants are known to invent, and known harmful packages. - Known fault in 0.1.0: a scan on a fresh install with no API keys failed in a real run on 2026-10-07. `crowsnest install ` and `/health` worked the same day. See https://crowsnest.co.in/docs/troubleshooting. - Docker image note, as of 2026-10-07: the built-in lists of known harmful packages and known AI-invented names were empty in a fresh Docker container, so those two checks have nothing to match there. - Every API key is optional. Without keys Crowsnest uses cached data. Optional: Anthropic, GitHub, Socket, npm. Slack keys are needed only for the bot. - Requirements: Docker, or Python 3.12+ and Node 18+. Crowsnest listens on port 8000 and the dashboard on port 3000. - Slack has four commands: `/crowsnest-scan`, `/crowsnest-investigate`, `/crowsnest-blast-radius` and `/crowsnest-status`. It posts only the most serious calls to `#security` by default. - VS Code covers JavaScript, TypeScript, JSX, TSX and Python. It warns from risk 0.5 by default (`crowsnest.riskThreshold`), waits 1 second after typing and remembers a result for 5 minutes. - Lockfiles and results stay on your machine. Optional calls to Anthropic, Socket and GitHub happen only when you set a key. Crowsnest sends no usage data to its authors. The website counts page views with Vercel Web Analytics and sets no cookies; the tool on your machine has no analytics. ## Questions ### What is Crowsnest? Crowsnest is a free, open-source supply chain security tool that you run yourself: it checks the packages in your software project and tells you, in plain words, which ones to hold back before they cause harm. Each package gets a call: Clear, Watch or Hold. ### What is slopsquatting? Slopsquatting is when an attacker registers a package name that an AI coding assistant has invented, then waits for someone to install it. Crowsnest warns you about new, little-used packages with names like that before they land in your project. ### Do I need API keys? No. Every key is optional. Without keys, Crowsnest uses cached data and still runs. Keys let it look things up live: a Socket key for threat alerts, a GitHub token for repository details, and an Anthropic key for AI-assisted analysis. ### Does it stop npm install? Only when you install through Crowsnest. crowsnest install checks first and stops at risk 0.6 or above. A plain npm install is not checked. If Crowsnest cannot be reached, the install goes ahead and you see a warning. ### Does my code leave my machine? Your lockfile and results stay on your machine. A scan sends package names to the npm registry and OSV. Optional keys add calls to Socket, GitHub and Anthropic, and only when you set them. The Privacy page lists every one. ### What does it cost? Nothing. Crowsnest is free and open source under the Apache-2.0 licence. You run it yourself, so your only costs are your own machine and any optional services whose keys you choose to add. ## Docs - [Introduction](https://crowsnest.co.in/docs): Learn what Crowsnest is, who it is for, and how to read a call: Clear, Watch or Hold. A plain introduction to a free, open-source package checker. - [Quickstart](https://crowsnest.co.in/docs/quickstart): Install Docker, run three commands, and open the Crowsnest dashboard at localhost:3000. No account and no API keys needed. A step-by-step quickstart. - [Installation](https://crowsnest.co.in/docs/installation): Install Crowsnest with Docker or from source on macOS, Linux or Windows. Requirements, the command line tool, updating and uninstalling, step by step. - [CLI usage](https://crowsnest.co.in/docs/cli): Use the crowsnest command to scan a project, check one package and stop risky installs at risk 0.6. Commands, options and exit codes for your terminal. - [Using the dashboard](https://crowsnest.co.in/docs/dashboard): Read a Crowsnest call in the dashboard: what happened, how serious it is and what to do. A guide to Horizon, Lookout, Hold and Log, plus shortcuts. - [Slack bot](https://crowsnest.co.in/docs/integrations/slack): Set up the Crowsnest Slack bot to post serious calls to a channel and run four slash commands. Keys, steps and fixes, with no public web address needed. - [VS Code extension](https://crowsnest.co.in/docs/integrations/vscode): Get warnings in the margin of VS Code when you import a risky package. Install from source, use three commands, and set three options. JS, TS and Python. - [Configuration](https://crowsnest.co.in/docs/configuration): Crowsnest runs with no settings. See which API keys are optional, what each one adds, where to put them and what happens when one is missing. - [FAQ](https://crowsnest.co.in/docs/faq): Answers to common questions about Crowsnest: what it is, whether it needs API keys, what it costs, what it can't see and what to do when it says Hold. - [Troubleshooting](https://crowsnest.co.in/docs/troubleshooting): Fix common Crowsnest problems: a dashboard showing Offline, port 8000 in use, the file-in-use error, Docker not starting, and a scan that finds nothing. - [Contributing](https://crowsnest.co.in/docs/contributing): Help improve Crowsnest. Report a bug, ask for a feature or send a change. How the issue forms, pull requests and automatic checks work, in six steps. ## Blog - [What is slopsquatting?](https://crowsnest.co.in/blog/what-is-slopsquatting): Slopsquatting is when attackers register package names that AI assistants invent. What it is, why it works, and how to stay safe when you install packages. - [How to stay safe from malicious packages.](https://crowsnest.co.in/blog/how-to-stay-safe-from-malicious-packages): A short checklist for installing packages safely: check age and downloads, check the name, install through Crowsnest, commit your lockfile, act on a Hold. - [What to do when Crowsnest says Hold.](https://crowsnest.co.in/blog/what-to-do-when-crowsnest-says-hold): A calm walkthrough of a Crowsnest Hold: read the call, see who else is affected, take the first step, then scan again. What to do and what to avoid. - [Crowsnest 0.1.0 release notes.](https://crowsnest.co.in/blog/crowsnest-0-1-0-release-notes): Release notes for Crowsnest 0.1.0: the dashboard, the safe-install command, the Slack bot and the VS Code extension, plus what it cannot do yet. ## Glossary - [Slopsquatting](https://crowsnest.co.in/glossary/slopsquatting): Slopsquatting is registering a package name an AI assistant invented, so anyone who installs the suggestion gets the attacker's code. Meaning and defences. - [Typosquatting](https://crowsnest.co.in/glossary/typosquatting): Typosquatting is publishing a package with a name almost the same as a popular one, hoping for a typing slip. Definition, why it matters, and how to stay safe. - [Dependency confusion](https://crowsnest.co.in/glossary/dependency-confusion): Dependency confusion is publishing a public package under the name of a private one so a build installs the wrong version. Definition and how to stay safe. - [Maintainer takeover](https://crowsnest.co.in/glossary/maintainer-takeover): A maintainer takeover is when a package passes to a new, often unvetted account that changes it in a later release. Definition and how to stay safe. - [Lockfile](https://crowsnest.co.in/glossary/lockfile): A lockfile records the exact version of every package your project installed. What it is, why you should commit it, and how it helps you stay safe. - [Supply chain attack](https://crowsnest.co.in/glossary/supply-chain-attack): A supply chain attack harms you by tampering with something you rely on, such as a software package. Definition, why it matters and how to stay safe. ## Optional - [About](https://crowsnest.co.in/about) - [Privacy](https://crowsnest.co.in/privacy) - [Report a problem](https://github.com/devampatel03/Crowsnest/issues/new/choose) - [Full text of these pages](https://crowsnest.co.in/llms-full.txt) - [RSS](https://crowsnest.co.in/rss.xml) This site welcomes indexing and citation of the public pages. The dashboard routes (/horizon, /lookout, /hold, /log) show one installation data and are excluded. Cite the definition above and the page under /docs or /glossary that matches the question. Each content page is also available as Markdown by adding .md to its URL.