Skip to main content

NDM

NDM — Node Dependency Monitor

Understand what your npm packages actually do.

Why NDM?​

Modern software depends heavily on open-source packages. With the npm ecosystem containing millions of packages, developers can add powerful functionality to their projects within seconds.

But every dependency also introduces a certain level of risk.

Recent supply-chain attacks have shown how quickly a compromised package can affect thousands of projects and millions of users. In some cases, malicious code was hidden inside otherwise legitimate packages and executed automatically during installation or runtime. Other attacks targeted repositories and CI/CD environments to steal secrets and credentials.

These incidents make one thing clear:

Knowing what a package claims to do is not always enough. You also need to know what it actually does.

This is where NDM comes in.

What is NDM?​

NDM (Node Dependency Monitor) is a security tool for analyzing npm packages and their behavior.

Instead of only looking at package metadata or source code, NDM combines different analysis methods to build a clearer picture of what a package does.

  • Static analysis examines a package before it is executed.
  • Dynamic analysis observes its behavior while it is running.
  • Sandboxing isolates packages so potentially malicious behavior can be analyzed safely.
  • Behavior analysis evaluates events such as filesystem access, network activity, process execution, secret access, and persistence.

The results are turned into an understandable report that helps developers identify suspicious behavior and make better-informed decisions about their dependencies.

Why does this matter?​

The npm ecosystem is enormous, and new packages are published every day. Attackers can take advantage of this scale through techniques such as malicious packages, typosquatting, compromised dependencies, and supply-chain attacks.

Recent incidents have affected hundreds of packages and thousands of repositories, with some compromised packages reaching millions or even billions of downloads.

NDM was created to make analyzing these dependencies more accessible and transparent.

Our goal is simple:

Don't just trust your dependencies. Understand them.