About NPM Spy
NPM Spy is an advanced Web3-powered security scanner designed to identify websites using vulnerable npm packages. In the rapidly evolving blockchain and DeFi ecosystem, supply chain attacks pose significant threats to smart contracts, dApps, and user funds.
🚨Why NPM Spy Exists
Supply chain attacks have become the primary attack vector in the Web3 space. Malicious actors compromise popular npm packages, affecting thousands of DeFi protocols, NFT marketplaces, and blockchain applications. NPM Spy helps identify when Web3 applications are using known vulnerable versions of packages that could compromise user wallets, smart contracts, or sensitive data.
⚙️How It Works
Deep URL Analysis
Enter a dApp or website URL to begin comprehensive security analysis
Bundle Extraction & Analysis
Advanced parsing of JavaScript bundles, smart contract interfaces, and Web3 dependencies
Vulnerability Detection
Cross-reference against known malicious packages and Web3-specific attack vectors
Security Report
Generate detailed security intelligence reports with actionable insights
🛡️Detection Methods
🔍 CDN Analysis
Scans popular CDN services for known vulnerable package versions
📦 Bundle Inspection
Deep analysis of webpack bundles and module dependencies
🔐 Obfuscation Detection
Identifies suspicious code patterns and obfuscation techniques
🎯 Keyword Scanning
Searches for malicious keywords and suspicious function calls
⚠️Important Disclaimers
This tool is for educational and research purposes only
May not detect all packages due to advanced obfuscation or dynamic loading
Always verify findings through multiple security audits and official channels
Beta version - results should be cross-verified with other security tools
🚀 Ready to Secure Web3?
Start analyzing dApps and Web3 applications for supply chain vulnerabilities
Start Scanning