🕵️‍♂️ Dependencies Should Not Be Silent: Inspect What Your npm Packages Actually Do

npm-telemetry is a lightweight CLI and Node.js library that inspects npm packages before installation, detecting sensitive capabilities such as network access, file system operations, environment variable reads, child process spawning, and dynamic code execution. Created in response to growing npm supply-chain attacks, it serves as a 'nutrition label' for packages, providing an analysis coverage score and supporting programmatic integration into CI pipelines.