# npq を Homebrew でインストール npq のインストール経路、実行ファイル、メタデータ、AI エージェント向けセキュリティノートを確認します。 ## インストール ```sh sudo av install brew:npq ``` 追加のインストールコマンド: ### macOS - Homebrew (100%): ```sh brew install npq ``` 証拠: local Homebrew formula metadata ## パッケージ情報 - **パッケージキー:** brew:npq - **パッケージマネージャ:** Homebrew - **バージョン:** 3.23.3 - **ソース概要:** Audit npm packages before you install them - **ホームページ:** - **最終更新:** 2026-07-24T21:22:04Z - **生成日時:** 2026-08-03T19:37:03+00:00 ## 実行可能ファイル - npq (エイリアス) - npq-hero (エイリアス) ## インストール挙動 - Bottle: 利用不可 ## バージョンと鮮度 - ページ生成日: 2026-08-03 - マネージャ版: 3.23.3 ## プロジェクトの歴史と使われ方 npq is a Node.js command-line security wrapper that audits npm package installs before handing off to the real package manager. The npm package was created on 2017-11-28, and the GitHub repository was created on 2017-12-14. ### プロジェクトの歴史 The project grew out of concern about npm supply-chain risk: newly published packages, low-download typo targets, missing metadata, vulnerable packages, and pre/post-install scripts. Its README says npq performs syntactic heuristics and queries a CVE database, then delegates the actual install to npm by default or another package manager selected through NPQ_PKG_MGR. The npm registry metadata consulted for this batch reported latest version 3.19.6 published on 2026-06-03 and 176 published versions. The README also documents npq-hero, an alias/wrapper path for embedding npq into day-to-day npm usage. ### 採用の歴史 npq is smaller than npm-check-updates but has durable adoption among JavaScript developers who want an interactive pre-install safety check. Its README lists third-party coverage and mentions in npm security discussions, and the GitHub metadata consulted for this batch reported about 1.8k stars. npm's public downloads API reported 32,098 downloads for npq from 2026-05-30 through 2026-06-28 and 171,829 downloads from 2025-06-29 through 2026-06-28. Homebrew analytics reported 1,862 formula installs over its 365-day window. ### 使われ方 Package nerds use npq when installing unfamiliar packages, especially ad hoc CLI tools or direct dependencies discovered during development. Typical usage is npq install express, npx npq install express --dry-run, or aliasing npm to npq-hero so package installs pass through the checks automatically. npq's checks are intentionally heuristic, not a proof of safety. The useful behavior is friction: warn on risky signals such as very new packages, missing README or license metadata, known vulnerabilities, install scripts, maintainer/publisher concerns, and low popularity before executing the actual package-manager install. ### パッケージ好きにとっての重要性 npq represents the npm ecosystem's shift from post-install vulnerability scanning toward pre-install package-health review. It is part of the same cultural space as minimum release age, lockfile linting, provenance checks, and package firewalls. ### タイムライン - 2017-11-28: npm registry package npq created. - 2017-12-14: GitHub repository lirantal/npq created. - 2026-06-03: npm registry metadata reports version 3.19.6 published. ### Related projects - npm audit - Snyk - Socket Firewall - lockfile-lint - npq-hero - pnpm - bun ### ソース - - - - - - - ## セキュリティノート npq に一致するローカルシークレット処理マニフェストは見つかりませんでした。将来の対応で安定したパッケージ URL を使えるよう、Nucleus パッケージメタデータはここに公開されています。 ## Combined YAML source View the package source record on GitHub. [combined/npq.yml](https://github.com/mxcl/pkgdb/blob/main/combined/npq.yml) ## ソース - pkg.so package database - Geiger risk classifier - curated package history - pkgdb category and tag curation - cross-ecosystem install command graph