Image: github.com · Offline npm package auditing and reproducible REA analyses of published open-source artifacts - martinlofranodeoliveira/opensource-rea-lab
Worked Proof shown
Offline auditing of npm packages
Reproducible REA analyses of published open-source artifacts.
—
Credits
- Repository account martinlofranodeoliveira Source ↗
The full story
Open-source REA Lab is a small public lab for reproducible analysis of published open-source software. Its first tool, npm Tarball Audit, inspects an npm package file before you install it. It reads the archive offline and checks its identity and structure, without ever running npm, the package's JavaScript or its install scripts.
How it was done
Tools
Themes
Loading themes…
Sources
From the maker's own write-up or code. We summarise what they report; we haven't tested it ourselves.
- Awesome REA list: opensource-rea-labRepository account: martinlofranodeoliveira
The lab and the npm audit tool.