Quarantine Package

Runs an npm package in a sealed sandbox and tells you what it tried to do before you install it.

One-click demos

• express@4.21.2: a popular benign package
• Install script that downloads (repo fixture): repo fixture, never published: a legitimate-looking install script that checks for a binary download (expected: review, explained)
• Hostile package (repo fixture): repo fixture, never published: writes /etc, home, looks for docker.sock, counts key-like env vars, POSTs to recolector.example.com