Introduction

GoAudit is a sandbox security scanner for CLI commands. It inspects install commands and project upgrades for suspicious file reads, writes, process execution, and network behavior.

Scan single commands with goaudit scan (npm, pnpm, bun, pip, or curl | sh) or audit an entire JS project with goaudit scan-project.

Installation

Install the latest version with Go:

Requires Docker. gVisor (runsc) is strongly recommended for real isolation.

Usage

Scan a single install or script command inside the sandbox:

$ goaudit scan "npm install lodash"
$ goaudit scan "pnpm add <package>"
$ goaudit scan "bun add <package>"
$ goaudit scan "pip install <package>"
$ goaudit scan "curl -fsSL https://example.com/install.sh | sh"

# Live findings + CI JSON
$ goaudit scan "npm install <package>" --verbose
$ goaudit scan "npm install <package>" --ci

# Network / static analysis controls
$ goaudit scan "npm install <package>" --network off
$ goaudit scan "npm install <package>" --offline
$ goaudit scan "curl -fsSL https://example.com/install.sh | sh" \
    --allow-domain example.com --max-remote-depth 1

# Sandbox options
$ goaudit scan "npm install <package>" --run-as-root
$ goaudit scan "npm install <package>" --skip-probe
$ goaudit scan "npm install <package>" --warm-cache
$ goaudit scan "npm install <package>" --no-cache
$ goaudit scan "npm install <package>" --fail-on malicious

Yarn projects have no scan-project profile, but you can still audit an explicit command with goaudit scan "yarn install".

scan-project

Audit an existing JavaScript project before upgrading dependencies. GoAudit reads package.json, detects npm / pnpm / bun, checks packages against the registry, then runs the upgrade install in a sandbox. Your host node_modules is not modified.

$ goaudit scan-project .
$ goaudit scan-project ~/mywebsite --upgrade-mode ncu
$ goaudit scan-project ~/monorepo --upgrade-mode update --ci
$ goaudit scan-project ~/app --manager pnpm
$ goaudit scan-project ~/app --include-transitive
$ goaudit scan-project ~/app --probe-all
$ goaudit scan-project ~/app --skip-probe
$ goaudit scan-project . --node-image node:current-slim --warm-cache

Upgrade modes

Runtime Probe

After install, GoAudit can load each package entrypoint (require / dynamic import) and run package CLI bin entries with --help under strace.

• It does not exercise delayed timers, workers, interactive prompts, or arbitrary exported APIs.
• Disable with --skip-probe.
• For projects, --probe-all probes every direct dependency instead of only suspicious ones.

Project Staging

scan-project stages install inputs (manifests and lockfiles) into the sandbox by default so install scripts cannot read host secrets via /project-ro.

• Pass --mount-project for a full-tree stage with known secret paths redacted.
• Multi-local scan installs refuse mounting the working directory unless --mount-cwd is set.

Cache

GoAudit caches prepared sandbox containers to speed up repeat scans.

$ goaudit cache status
$ goaudit cache clean
$ goaudit cache clean --runtime runsc
$ goaudit cache clean --runtime runc

Use --cache-dir or GOAUDIT_CACHE_DIR to store cache entries elsewhere. --warm-cache prepares the sandbox without running a scan.

Demo Output

Reports group install-time behavior, runtime probe results, static analysis, network activity, and sandbox reliability.

Security & Honeypots

Target commands run as a non-root sandbox user by default. GoAudit injects realistic decoy credentials —.ssh/id_rsa, .aws/credentials, Kubernetes configs, .env, .npmrc, and .git-credentials — to bait credential theft.

The tracing engine watches for environment theft (/proc/self/environ), process injection (ptrace), fileless execution (memfd_create), privilege escalation (setuid / setgid), capability changes, namespace escape tooling, and unauthorized network listeners.

Noise reduction: redundant network calls are deduplicated, expected registry traffic and common lifecycle noise are suppressed, and benign sandbox setup (for example su/PAM setuid during prep) is ignored before payload execution.

Requirements

• Docker installed and running
• gVisor (highly recommended for real isolation)

gVisor (runsc) on Fedora / SELinux

GoAudit uses gVisor when Docker lists runsc in docker info runtimes. Installing the binary is not enough — register it with Docker (for example in /etc/docker/daemon.json):

{
  "runtimes": {
    "runsc": {
      "path": "/usr/local/bin/runsc",
      "runtimeArgs": ["--debug=false", "--platform=ptrace"]
    }
  },
  "default-runtime": "runc"
}

Use runsc help platform for valid --platform values. Restart Docker, then verify:

docker info | grep -i runtimes