# Checking for installed npm packages and dependencies

**URL:** <https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701>\
**Category:** Share Your Projects\
**Tags:** security, tools\
**Created:** [1 April 2026 15:22 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701 "2026-04-01T15:22:48Z")\
**Posts on this page:** 19\
**Page:** 1

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [1 April 2026 15:22 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/1 "2026-04-01T15:22:48Z")

</div>

In recent months, there have been a number of high-profile supply-chain attacks on the npm package repository and some key packages.

To make it easier to see whether you are impacted by such a compromise, I've created a quick tool that lets you check whether you have a compromised package installed and what it belongs to.

Actual checks for whether you have been infected (just because you have a compromised version, it does not necessarily mean you've actually run the compromised code in the package) are beyond the scope of a simple checker I'm afraid and you will need to review the information about the attack to know what, if anything, you need to do.

The tool is published here:  
[https://www.npmjs.com/package/npm-supply-chain-check](https://www.npmjs.com/package/npm-supply-chain-check)  
You should, of course, do a quick check of the code before running it to make sure you are happy. Note though, that I've locked down the package and its source GitHub to prevent unwanted changes. In addition, the package has no external dependencies at all.

You don't need to install it, you can run it with `npx` instead if you prefer:

Here is an example of checking against the latest attack:

```auto
cd ~/.node-red
npx npm-supply-chain-check axios
npx npm-supply-chain-check axios global

```

Note that you should check both the local and global locations.

---

<div class="post-metadata">

**Author:** ![edje11](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/edje11/32/572_2.png) [@edje11](https://discourse.nodered.org/u/edje11)\
**Post date:** [1 April 2026 18:01 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/2 "2026-04-01T18:01:25Z")

</div>

Thanks for the tool, watched a couple of video's last week about this hack and was also interested if this apply to NR or Z2M.

After running your tool it found **Axios 1.13.5 installed node-red-admin -\> axios**.

No sure for me if this is an compromised version I asked Chatgpt if the 1.13.5 version is compromised:

Short answer: **No — `axios@1.13.5` is not one of the compromised versions.**

### What actually happened

There **was a real supply chain attack** on Axios in late March 2026:

- Attackers compromised an npm maintainer account
- They published **malicious versions** :
  - `axios@1.14.1`
  - `axios@0.30.4`

- These versions injected a fake dependency (`plain-crypto-js`) that installed a **remote access trojan (RAT)** on install
- The malicious releases were live for only **~2–3 hours before removal**

---

<div class="post-metadata">

**Author:** ![gregorius](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gregorius/32/73816_2.png) [@gregorius](https://discourse.nodered.org/u/gregorius)\
**Post date:** [2 April 2026 06:39 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/3 "2026-04-02T06:39:09Z")

</div>

> [@TotallyInformation](#):
>
> /npm-supply-chain-check

Do you check for the [RAT files](https://github.com/theNetworkChuck/axios-attack-guide/blob/main/README.md#iocs-indicators-of-compromise) --\>

| OS | Path | Disguised As |
| --- | --- | --- |
| macOS | /Library/Caches/com.apple.act.mond | Apple system cache |
| Windows | %PROGRAMDATA%\wt.exe | Windows Terminal |
| Linux | /tmp/ld.py | Generic temp file |

Looking at the source code, you seem only to check through the various package.json files and folders.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [2 April 2026 09:50 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/4 "2026-04-02T09:50:18Z")

</div>

> [@gregorius](#):
>
> Looking at the source code, you seem only to check through the various package.json files and folders.

Yes, this isn't meant to be a comprehensive security tool but rather something that anyone can use, regardless of experience, to do a quick check to see if they may have a problem that should be followed up.

---

<div class="post-metadata">

**Author:** ![gregorius](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gregorius/32/73816_2.png) [@gregorius](https://discourse.nodered.org/u/gregorius)\
**Post date:** [3 April 2026 07:14 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/5 "2026-04-03T07:14:31Z")

</div>

> [@TotallyInformation](#):
>
> quick check to see if they may have a problem

According to the [write up](https://github.com/theNetworkChuck/axios-attack-guide/blob/main/README.md#what-happened--the-full-attack-chain), the attack actually cleans up the package.json files leaving the RAT behind. If I understand correctly. So running this script might well give one a false sense of security because the indicators the script checks for have already been cleaned away, leaving the executable behind.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [3 April 2026 10:36 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/6 "2026-04-03T10:36:12Z")

</div>

No, I don't think so, it uses `npm ls` to do the checks which will, I believe, check down the tree regardless of the package.json. The package.json is only used to identify root folders to check (folder contains package.json). Correct me if I'm wrong.

---

<div class="post-metadata">

**Author:** ![AllanOricil](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/allanoricil/32/106911_2.png) [@AllanOricil](https://discourse.nodered.org/u/AllanOricil)\
**Post date:** [3 April 2026 19:57 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/7 "2026-04-03T19:57:35Z")

</div>

Another reason for using Sentinel's custom package installer. It wont run package scripts unless an Admin confirms he wants to proceed. In the warning message it will ask people to verify the changes and confirm.

Additionally, packages are going to be setup and analyzed in a ephemeral docker container before being added to the node\_modules nodered sees. This way the attack surface caused by these scripts, if they are accidentally run, will be limited to the container.

---

<div class="post-metadata">

**Author:** ![gregorius](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gregorius/32/73816_2.png) [@gregorius](https://discourse.nodered.org/u/gregorius)\
**Post date:** [4 April 2026 07:08 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/8 "2026-04-04T07:08:06Z")

</div>

> [@AllanOricil](#):
>
> setup and analyzed in a ephemeral docker container

Minor question, does this work on environments without docker, e.g. raspberries? Also how does this work if NR is run inside a docker container? [Docker within docker](https://devopscube.com/run-docker-in-docker/) is possible but needs extra configuration step.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [4 April 2026 08:38 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/9 "2026-04-04T08:38:56Z")

</div>

> [@gregorius](#):
>
> does this work

If you are asking Allan about his tool, perhaps you could take that to a different thread please?

Otherwise, regarding my simple tool. It should work fine inside a Docker container. You just need to access that containers command line.

---

<div class="post-metadata">

**Author:** ![AllanOricil](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/allanoricil/32/106911_2.png) [@AllanOricil](https://discourse.nodered.org/u/AllanOricil)\
**Post date:** [4 April 2026 10:09 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/10 "2026-04-04T10:09:13Z")

</div>

> [@gregorius](#):
>
> Minor question, does this work on environments without docker, e.g. raspberries? Also how does this work if NR is run inside a docker container? [Docker within docker](https://devopscube.com/run-docker-in-docker/) is possible but needs extra configuration step.

Unfortunately this only works on environments with docker.

I designed it to run side by side, but I guess it could work with Docker In Docker if the base NR image supports it.

---

<div class="post-metadata">

**Author:** ![XaMic](https://avatars.discourse-cdn.com/v4/letter/x/cab0a1/32.png) [@XaMic](https://discourse.nodered.org/u/XaMic)\
**Post date:** [7 April 2026 08:32 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/11 "2026-04-07T08:32:48Z")

</div>

When I run "npx npm-supply-chain-check" it says that I have to install "npm-supply-chain-check@1.0.0" What is it for and do I have to install it ?

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [7 April 2026 08:51 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/12 "2026-04-07T08:51:33Z")

</div>

> [@XaMic](#):
>
> What is it for and do I have to install it

Read the rest of the thread to see what it is for. As I understand it, npx does a temporary install into a cache, then runs it and removes it again.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [7 April 2026 09:01 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/13 "2026-04-07T09:01:55Z")

</div>

Just to note that the check does not appear to follow modules installed in local files. I have a locally built version of @flowfuse/node-red-dashboard, so in package.json I see  
`"@flowfuse/node-red-dashboard": "file:../nodes/node-red-dashboard",`

`npm list axios` shows

```auto
└─┬ @flowfuse/node-red-dashboard@1.30.2 -> ./../nodes/node-red-dashboard
  ├── axios@1.13.5

```

but the script says that axios is not found in this projects lock file.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [7 April 2026 12:05 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/14 "2026-04-07T12:05:58Z")

</div>

> [@XaMic](#):
>
> npx npm-supply-chain-check

It does (partially) follow local file installs. On my dev instance, I have a local development version of uibuilder installed. Searching for "express", I get these results (NB: the package.json in my userDir folder has a name of `node-red-userDir`)

```auto
  ***FOUND: 3 installed instances of "express"***

  Installed version : 5.2.1
  Location : nested — node_modules/@modelcontextprotocol/sdk/node_modules/express
  Depended on by :
    • @modelcontextprotocol/sdk

  Installed version : 4.22.1
  Location : top-level (hoisted)
  Depended on by :
    • ../../node-red-contrib-uibuilder
    • @flowfuse/node-red-dashboard
    • express-rate-limit

  Installed version : 4.22.1
  Location : nested — node_modules/node-red-contrib-web-worldmap/node_modules/express
  Depended on by :
    • node-red-contrib-web-worldmap

```

Which does indeed include the version in the local uibuilder install.

However, as you point out, if the top-level lock file doesn't include the searched for package **AND** it isn't used anywhere else, then it doesn't find it, as in this example searching for `jsdom`:

```auto
  Checking node-red-userdir ... not found

──────────────────────────────────────────────────────────────────────
Project : node-red-userdir
Rel path: .
Path : D:\src\nr\data
──────────────────────────────────────────────────────────────────────
  (not found — "jsdom" is not in this project's lock file)

```

```auto
npm ls jsdom
node-red-userdir@2.2.0 D:\src\nr\data
`-- node-red-contrib-uibuilder@7.6.0 -> .\..\..\node-red-contrib-uibuilder
  `-- jsdom@28.1.0

```

So there is an issue where it clearly isn't fully walking down the tree of package.json files whereas `npm ls` does.

~~I'll try to see if I can fix that~~. Thanks for pointing it out.

Already fixed and published as v1.1.0 😃

---

<div class="post-metadata">

**Author:** ![XaMic](https://avatars.discourse-cdn.com/v4/letter/x/cab0a1/32.png) [@XaMic](https://discourse.nodered.org/u/XaMic)\
**Post date:** [7 April 2026 13:09 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/15 "2026-04-07T13:09:44Z")

</div>

Thank you for the fix.  
My node-red package is in a docker container, and when I run npm-supply-chain-check I get this result

```auto
══════════════════════════════════════════════════════════════════════
Supply-Chain Dependency Checker
══════════════════════════════════════════════════════════════════════
Target : node-red
Scope : /usr/src/node-red
══════════════════════════════════════════════════════════════════════

Searching for npm project roots (directories with package.json + node_modules)...
Found 1 project root(s). Analysing lock files...

  Checking node-red-docker ... FOUND (1 instance)

──────────────────────────────────────────────────────────────────────
Project : node-red-docker
Rel path: .
Path : /usr/src/node-red
──────────────────────────────────────────────────────────────────────
  ***FOUND: 1 installed instance of "node-red"***

  Installed version : 4.1.1
  Location : top-level (hoisted)
  Direct dependency : yes
  Depended on by :
    • (project root / direct dependency)

══════════════════════════════════════════════════════════════════════
SUMMARY
──────────────────────────────────────────────────────────────────────
  Projects scanned : 1
  Skipped (no lock file): 0
  "node-red" found in : 1 project(s)

  ***Review the dependency details above for version risks.***
  ***Check the package's changelog and known CVEs immediately.***
══════════════════════════════════════════════════════════════════════

```

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [7 April 2026 14:29 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/16 "2026-04-07T14:29:11Z")

</div>

> [@TotallyInformation](#):
>
> fixed and published as v1.1.0

Yep, sorted.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [7 April 2026 18:04 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/17 "2026-04-07T18:04:38Z")

</div>

> [@XaMic](#):
>
> My node-red package is in a docker container, and when I run npm-supply-chain-check I get this resul

Yes, that is correct, you searched for node-red and it found it.

---

<div class="post-metadata">

**Author:** ![AllanOricil](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/allanoricil/32/106911_2.png) [@AllanOricil](https://discourse.nodered.org/u/AllanOricil)\
**Post date:** [11 April 2026 16:10 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/18 "2026-04-11T16:10:30Z")

</div>

(post deleted by author)

---

<div class="post-metadata">

**Author:** ![AllanOricil](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/allanoricil/32/106911_2.png) [@AllanOricil](https://discourse.nodered.org/u/AllanOricil)\
**Post date:** [12 April 2026 21:33 UTC](https://discourse.nodered.org/t/checking-for-installed-npm-packages-and-dependencies/100701/19 "2026-04-12T21:33:24Z")

</div>

> [@gregorius](#):
>
> Minor question, does this work on environments without docker, e.g. raspberries? Also how does this work if NR is run inside a docker container? [Docker within docker](https://devopscube.com/run-docker-in-docker/) is possible but needs extra configuration step.

I won't be able to make it work with DinD setups because it adds a new set of threats and complexity that will make the security guards via filesystem way more fragile.