Generated source
This hub uses the same local package data as individual package pages: pkg.so package metadata, Homebrew enrichment, Geiger classifier output, secret-handling manifests, and approval-gate seeds where available.
ecosystem
npm packages with local package pages and command-line or developer workflow metadata.
summary
npm command packages currently includes 2225 package catalog entries. 0 have protected-tool coverage, 0 have approval-gate metadata, and 0 have non-low Geiger classifier findings. The grouping comes from package metadata, so it can stay current as that metadata changes.
This hub uses the same local package data as individual package pages: pkg.so package metadata, Homebrew enrichment, Geiger classifier output, secret-handling manifests, and approval-gate seeds where available.
Use the hub to find command families that need tighter secret injection, approval gates, or manual review before agents run them.
packages
| Package | Manager | Signals | Why it appears here |
|---|---|---|---|
| which | npm | v7.0.0 | Like which(1) unix command. Find the first instance of an executable in the PATH. |
| js-yaml | npm | v5.4.1 | YAML 1.2 parser and serializer |
| acorn | npm | v8.18.0 | ECMAScript parser |
| nanoid | npm | v6.0.1 | A tiny (118 bytes), secure URL-friendly unique string ID generator |
| resolve | npm | v1.22.12 | resolve like require.resolve() on behalf of files asynchronously and synchronously |
| yaml | npm | v2.9.1 | JavaScript parser and stringifier for YAML |
| browserslist | npm | v4.28.9 | Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset |
| jiti | npm | v2.7.0 | Runtime typescript and ESM support for Node.js |
| jsesc | npm | v3.1.0 | Given some data, jsesc returns the shortest possible stringified & ASCII-safe representation of that data. |
| update-browserslist-db | npm | v1.3.3 | CLI tool to update caniuse-lite to refresh target browsers from Browserslist config |
| rimraf | npm | v6.1.3 | A deep deletion module for node (like rm -rf) |
| baseline-browser-mapping | npm | v2.11.21 | A library for obtaining browser versions with their maximum supported Baseline feature set and Widely Available status. |
| mime | npm | v4.1.0 | A comprehensive library for mime-type mapping |
| mkdirp | npm | v3.0.1 | Recursively mkdir, like mkdir -p |
| loose-envify | npm | v1.4.0 | Fast (and loose) selective process.env replacer using js-tokens instead of an AST |
| is-docker | npm | v4.0.0 | Check if the process is running inside a Docker container |
| vitest | npm | v5.0.0 | Next generation testing framework powered by Vite |
| playwright-core | npm | v1.63.0 | A high-level API to automate web browsers |
| rolldown | npm | v1.2.8 | Fast JavaScript/TypeScript bundler in Rust with Rollup-compatible API. |
| cssesc | npm | v3.0.0 | A JavaScript library for escaping CSS strings and identifiers while generating the shortest possible ASCII-only output. |
| tsx | npm | v4.23.13 | TypeScript Execute (tsx): Node.js enhanced with esbuild to run TypeScript & ESM files |
| playwright | npm | v1.63.0 | A high-level API to automate web browsers |
| fast-xml-parser | npm | v5.11.1 | Validate XML, Parse XML, Build XML without C/C++ based libraries |
| why-is-node-running | npm | v3.2.2 | Node is running but you don't know why? why-is-node-running is here to help you. |
| tldts | npm | v7.4.13 | Library to work against complex domain names, subdomains and URIs. |
| terser | npm | v5.51.2 | JavaScript parser, mangler/compressor and beautifier toolkit for ES6+ |
| nopt | npm | v10.0.1 | Option parsing for Node, supporting types, shorthands, etc. Used by npm. |
| eslint-config-prettier | npm | v10.1.8 | Turns off all rules that are unnecessary or might conflict with Prettier. |
| autoprefixer | npm | v10.5.5 | Parse CSS and add vendor prefixes to CSS rules using values from the Can I Use website |
| lz-string | npm | v1.5.0 | LZ-based compression algorithm |
| escodegen | npm | v2.1.0 | ECMAScript code generator |
| regjsparser | npm | v0.13.2 | Parsing the JavaScript's RegExp in JavaScript. |
| napi-postinstall | npm | v0.3.4 | The postinstall script helper for handling native bindings in legacy npm versions |
| node-gyp-build | npm | v4.8.4 | Build tool and bindings loader for node-gyp that supports prebuilds |
| ts-node | npm | v10.9.2 | TypeScript execution environment and REPL for node.js, with source map support |
| import-local | npm | v3.2.0 | Let a globally installed package use a locally installed version of itself if available |
| is-inside-container | npm | v1.0.0 | Check if the process is running inside a container (Docker/Podman) |
| jest | npm | v30.5.1 | Delightful JavaScript Testing. |
| uglify-js | npm | v3.19.3 | JavaScript parser, mangler/compressor and beautifier toolkit |
| sucrase | npm | v3.35.1 | Super-fast alternative to Babel for when you can target modern JS runtimes |
| crc-32 | npm | v1.2.2 | Pure-JS CRC-32 |
| tree-kill | npm | v1.2.2 | kill trees of processes |
| pino | npm | v10.3.1 | super fast, all natural json logger |
| he | npm | v1.2.0 | A robust HTML entities encoder/decoder with full Unicode support. |
| handlebars | npm | v4.7.9 | Handlebars provides the power necessary to let you build semantic templates effectively with no frustration |
| srvx | npm | v1.0.5 | Universal Server. |
| vite-node | npm | v6.0.0 | Vite as Node.js runtime |
| ejs | npm | v6.0.1 | Embedded JavaScript templates |
| image-size | npm | v2.0.2 | get dimensions of any image file |
| husky | npm | v9.1.7 | Modern native Git hooks |
| ua-parser-js | npm | v2.0.10 | Detect Browser, Engine, OS, CPU, and Device type/model from User-Agent & Client Hints data. Supports browser & node.js environment |
| node-gyp-build-optional-packages | npm | v5.2.2 | Build tool and bindings loader for node-gyp that supports prebuilds |
| flat | npm | v6.0.1 | Take a nested Javascript object and flatten it, or unflatten an object with delimited keys |
| markdown-it | npm | v15.0.2 | Markdown-it - modern pluggable markdown parser. |
| lint-staged | npm | v17.5.1 | Lint files staged by git |
| jake | npm | v12.10.1 | JavaScript build tool, similar to Make or Rake |
| msgpackr-extract | npm | v3.0.4 | Node addon for string extraction for msgpackr |
| extract-zip | npm | v2.0.1 | unzip a zip file into a directory using 100% javascript |
| ts-jest | npm | v29.4.12 | A Jest transformer with source map support that lets you use Jest to test projects written in TypeScript |
| giget | npm | v3.3.1 | Download templates and git repositories with pleasure! |
| cross-env | npm | v10.1.0 | Run scripts that set and use environment variables across platforms |
| katex | npm | v0.18.7 | Fast math typesetting for the web. |
| qrcode | npm | v1.5.4 | QRCode / 2d Barcode api with both server side and client side support using canvas |
| turbo | npm | v2.10.13 | Turborepo is the build system for coding agents. |
| astring | npm | v1.9.0 | JavaScript code generator from an ESTree-compliant AST. |
| is-ci | npm | v4.1.0 | Detect if the current environment is a CI server |
| storybook | npm | v10.6.0 | Storybook: Develop, document, and test UI components in isolation |
| pidtree | npm | v1.0.0 | Cross platform children list of a PID |
| create-jest | npm | v30.5.1 | Create a new Jest project |
| pino-pretty | npm | v13.1.3 | Prettifier for Pino log lines |
| concurrently | npm | v10.0.5 | Run commands concurrently |
| sha.js | npm | v2.4.12 | Streamable SHA hashes in pure javascript |