Skip to main content

Definitions

In this section, we will define some of the terms used in NDM, as people may have different interpretations of the same word.

Here are the definitions of some of the words and phrases used in NDM.

Core Concepts​

Dynamic Analysis​

Executing code to observe its actual behavior.

It runs a package inside a controlled environment, such as a sandbox or container, and monitors its activity, including file access, network calls, spawned processes, and installation scripts. This method is essential for detecting zero-day malware because it reveals behavior that static scanners cannot see.

Static Analysis​

Inspecting code without executing it.

Static analysis tools read source code, metadata, dependency graphs, and known vulnerability databases. These tools can detect known patterns, but they cannot reliably identify new or obfuscated malicious behavior.

Backend/server​

The part of an application that runs on a server and handles logic, data processing, and communication.
In NDM, the backend:

  • coordinates sandbox execution
  • stores analysis results
  • Calculate risk scores
  • expose an API for the CLI

CLI tool​

A command-line program with which users interact through text commands.

The NDM CLI is the user-facing interface that triggers scans, retrieves reports, and configures settings.

Package​

A distributable unit of code that is typically published on a registry, such as npm.

A package contains JavaScript/TypeScript code, metadata, dependencies, and optional installation scripts.

Sandbox​

An isolated execution environment designed to run untrusted code safely. A sandbox restricts:

  • filesystem access
  • network access
  • Process creation
  • System calls It allows NDM to observe behavior without risking the host system.

Dependency​

A dependency is a piece of external code that a package relies on, and they form a graph that is often large. Dependencies are a major attack vector in supply-chain security.

Detection accuracy terms​

True Positive:​

The system correctly identifies malicious behavior.

Example: NDM flags a package that contains malware.

True negative​

The system correctly identifies safe behavior.

Example: NDM does not flag a harmless package.

False positive​

The system incorrectly identifies safe behavior as malicious.

Example: A package with legitimate network calls is marked as dangerous.

False negative​

The system fails to detect malicious behavior.

Example: A package performs harmful actions, but NDM does not flag it.