Audit your dependencies.

GoAudit is a sandbox security scanner for CLI installs and project upgrades. It watches file, process, and network behavior before you trust a package.

npmpnpmbunpipcurl | sh
go install github.com/KushalMeghani1644/GoAudit-CLI/cmd/goaudit@latest
$ goaudit scan "cat ~/.aws/credentials"
GoAudit Report ──────────────────────────────────────────────────────────────── Command: cat ~/.aws/credentials
Verdict: MALICIOUS (confidence: 95)
Sandbox: gVisor (runsc)
What GoAudit Observed
1. During install, the target read credential-like files such as cloud credentials, SSH keys, Kubernetes config, npm tokens, or .env files.
Install-Time Behavior (observed in sandbox)
1. [CRITICAL] CREDENTIAL THEFT: /home/sandbox/.aws/credentials Details: Read sensitive files like SSH keys, AWS credentials, or .env secrets
Summary: 1 critical (1 install-time, 0 probe, 0 static), 0 warnings, 0 informational DO NOT INSTALL this package.
$ goaudit scan-project .
GoAudit Report ──────────────────────────────────────────────────────────────── Command: scan-project .
Verdict: SUSPICIOUS (confidence: 45)
Sandbox: gVisor (runsc)
Static Warnings
1. [WARNING] PACKAGE HAS LIFECYCLE SCRIPT: left-pad@1.3.0 Details: The package defines a lifecycle script in its registry metadata
Runtime Probe
- Runtime import probe completed without suspicious behavior - No credential access, suspicious writes, or unknown exfiltration detected
Summary: 0 critical (0 install-time, 0 probe, 0 static), 1 warnings, 0 informational Use --ci for full JSON output.

What GoAudit catches

Behavioral signals from a sandboxed run, plus static checks on commands and registry metadata.

FIG 0.1

Malicious behavior

Detect credential theft, persistence writes, reverse shells, and unexpected outbound connections inside a decoy sandbox.

FIG 0.2

Project scanning

Audit JS projects before upgrades. Stages manifests safely, checks registry metadata, and never mutates host node_modules.

FIG 0.3

Runtime probe

After install, optionally load package entrypoints and CLI bins under strace to catch post-install malice that lifecycle scripts miss.

FIG 0.4

Privilege & isolation

Catch setuid/setgid, capability changes, and namespace tricks. Prefer gVisor; fall back to runc with a clear reliability note.

Built for real workflows

From one-off install checks to CI gates on project upgrades.

Single command scans

Wrap npm, pnpm, bun, pip, or curl | sh and get a risk verdict with install-time and static findings.

Safe project staging

scan-project stages only manifests and lockfiles by default so install scripts cannot read host secrets.

CI-friendly output

Use --ci for JSON, --fail-on for exit codes, and --verbose for live findings while a scan runs.

Sandbox cache

Warm prepared containers with --warm-cache and manage them via goaudit cache status | clean.

Network controls

auto / on / off network policy, --offline static analysis, and --allow-domain for remote scripts.

Honeypot decoys

Realistic AWS, SSH, kube, .env, npmrc, and git credential decoys bait credential-stealing packages.