
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@condenast/opensource-check
Advanced tools
A Test Runner for verifying Open Source conventions in JavaScript projects
Proudly built by:
This utility can currently only be used for JavaScript/Node projects.
This utility can be used as a temporary dependency, global dependency or a dev dependency.
Head over to the usage section below on how to set it up based on your preference.
The utility accepts the following parameters:
This is great option for taking this a quick spin!
npx @condenast/opensource-check --path <your-project-path>
npx @condenast/opensource-check --path ./glamorous
npx @condenast/opensource-check --path ./xml-to-react --org condenast
This is a good option if you plan to use this frequently but don't want it to be a part of your project setup.
npm install -g @condenast/opensource-check
opensource-check --path <your-project-path>
opensource-check --path ./glamorous
opensource-check --path ./xml-to-react --org condenast
This is a wonderful option if you plan to use this as part of your project workflow including using in CI environment.
npm install -D @condenast/opensource-check
npx @condenast/opensource-check --path <your-project-path>
npx @condenast/opensource-check --path ./glamorous
npx @condenast/opensource-check --path ./xml-to-react --org condenast
This is a sample screenshot of running this utlility:

The current checklist of things that are verified by the utility on every run:
These documents are provided under the boilerplate directory for use by any project:
This is a list of projects that pass the Open Source Checks:
We were inspired by the ideas and code of the following projects:
See the list of contributors who participated in writing this tool.
FAQs
Test Runner for Open Source Conventions
The npm package @condenast/opensource-check receives a total of 65 weekly downloads. As such, @condenast/opensource-check popularity was classified as not popular.
We found that @condenast/opensource-check demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 357 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.