Static scanner detects supply-chain malware before npm install

A developer created a static scanner that detects supply-chain malware in repositories without running any code. It flags dangerous postinstall scripts, missing lockfile entries, and obfuscated code. The tool aims to catch attacks before npm install executes malicious payloads.