Lite is free. Pro adds this and the rest of the quality layer.
Adams forNode.js projects.
A Node project is mostly other people code. Adams guards your keys and helps you review what you pull in.
Lite and Pro
// the problem
What goes wrong
Packages are trustEvery dependency runs with your permissions. A misspelled name or an abandoned package is a way in.
Env files get committedA .env file that is not ignored is the most common way a Node project leaks a key.
// what adams does
What Adams does
Guards env and keysLite: keys in code and an env file that is not ignored are caught before commit.
Checks dependenciesPro: the secure check covers secrets and dependencies, and says what to update first.
Asks before adding onePro: before a new package, Adams asks whether the standard library or a small function would do.
// worked example
An example
Secrets and dependencies
Illustrative session.
~/project~/your-project · example
/adams:secure
Scope: secrets and dependencies
P1: .env is tracked by git
P2: two packages are far behind
Fix these findings? Yes (recommended)
// faq
Questions
Does it audit npm packages?
It looks at supply chain risk in your project. It is not a full vulnerability database.
Does it use npm itself?
It runs the checks you ask for, with your tools.
What is free?
Secret and git guards.
// related