Show HN: Who can publish to your NPM dependencies?

Category: security

Tags: npm, supply-chain-security, lockfile, security-scanner, dependency-analysis

Score: 5.7/10 (Innovation: 6, Technical: 5, Documentation: 4, Utility: 6)

Who's There? is a browser-based supply chain security tool that parses npm lockfiles to identify all maintainers who can publish to a project's dependencies, highlighting risky accounts via heuristics like purchasable email domains, new maintainers, and install-time scripts. It's a focused, privacy-friendly approach to a real problem, but the technical depth and documentation appear limited.

Target audience: backend devs, devops, security engineers

Repository: https://www.whosthere.dev/

View on Hacker News