Know what runs
before it runs.

GoAudit places package installs in a disposable sandbox and gives you the evidence to decide whether they deserve access to your machine.

Start auditing View on GitHub

See every move an install makes.

Lifecycle scripts can read credentials, alter files, or call home. GoAudit makes those actions visible inside an isolated environment before they become your problem.

goaudit / reportCOMPLETE

$ goaudit scan "npm install is-odd"

Runtime probe

import probe completed without suspicious behavior

no credential access, suspicious writes, or exfiltration

Static warnings

lifecycle scripts — this is common

Security verdict

Suspicious

0 critical, 1 warning, 13 informational findings — real output from a sandboxed scan.

Security that fits the flow.

Run one command. Get a record of what actually happened.

traced events

read~/.npmrctokens

execpostinstall.jslifecycle

connect23.22.13.113:443unknown

connectregistry.npmjs.orgexpected

Observe behavior

Capture file access, processes, and network calls from install scripts.

your machine

~/.ssh~/.aws.env

✕ secrets never cross

sandboxdestroyed on exit

decoy credentials — bait for theft

Keep your machine clean

Every audit runs apart from your credentials and working directory.

one command

$ goaudit scan "npm install is-odd"

sandbox: gVisor (runsc)

install traced · probe clean

verdict: suspicious (confidence: 55)

0 critical · 1 warning · 13 informational

Use your workflow

Audit npm, pnpm, and bun commands from your terminal.

Your next install deserves a sandbox.

Install GoAudit and check a package before its code touches your development environment.

$brew install --cask KushalMeghani1644/tap/goaudit