What is Vinum?

Analysis is static. Package code, install scripts, native binaries, and dependency executables are never run.

1. The published tarball is downloaded, checked, and extracted for analysis.
2. The manifest is inspected for install lifecycle hooks, entry points, and dependencies.
3. JavaScript and TypeScript files are parsed, and Vinum records capabilities such as network access, file access, subprocesses, and dynamic code evaluation.
4. Where possible, Vinum follows values from a source to a sink, for example a secret environment variable reaching a network request, and keeps the evidence path.
5. Vinum estimates reachability from declared entry points and install lifecycle scripts using imports and calls it can resolve. Many findings in code classified as outside those paths receive less weight; some sensitive findings retain their weight. Dynamic imports, conditional exports, and runtime-generated code can leave paths unresolved. Reachability is not a guarantee of what will run.

The Behavior tab lists what the package can do. A capability on its own is not a problem: most packages make network requests, read files, or start processes for ordinary reasons.

The Findings tab lists the observations that deserve a closer look, each with the source location that supports it. Open a finding to see exactly what was matched.

The score runs from 0 to 100 and starts at 100. Selected findings subtract points, weighted by confidence, evidence strength, and context. These include concerning flows, install-time exposure, obfuscation, persistence, and integrity concerns. Ordinary capabilities alone do not subtract points. Coverage gaps can also limit the score.

A high score means Vinum found little behavior that qualified for a deduction in the code it could analyze. It is not a measure of how likely a package is to be safe.

A low native analysis score reflects deductions for concerning findings or limits on analysis coverage. It does not prove the package is malicious. The combined score can also be limited by attributed threat intelligence, as described below.

OpenSSF Malicious Packages provides external reports about known package releases. These appear in a separate Threat intelligence section, with source references, affected versions and lookup coverage.

A verified active malicious report for the exact npm release provisionally limits the combined score to 20 out of 100. The original Vinum source-analysis score stays visible. This ceiling is a starting policy, not a validated probability of safety or maliciousness.

Reports about other versions, withdrawn or ambiguous reports, and unavailable intelligence do not change the score. No matching report does not establish that a package is clean. Intelligence can refresh without scanning the source again.

When part of a package could not be analyzed, the report says so and the score may be limited. If too little could be analyzed, Vinum shows Not enough evidence instead of a score.

Read the coverage notes in a report before relying on its score.

Vinum gives you the evidence it found. Whether a package is appropriate for your project depends on what you use it for, what it has access to, and how much risk you accept. That decision is yours.