https://cybertoolchain.io/tools/npq New releases and features in npq, tracked by The Cyber Toolchain. en Tue, 25 Aug 2026 16:10:45 GMT https://github.com/lirantal/npq/releases/tag/v3.27.0 https://github.com/lirantal/npq/releases/tag/v3.27.0 Tue, 25 Aug 2026 16:10:45 GMT npq v3.27.0 adds `--allow-non-interactive-install` flag and `NPQ_ALLOW_NON_INTERACTIVE_INSTALL` env var for safe CI/automated installs • Adds `--allow-non-interactive-install` CLI flag to explicitly authorize npq installs in non-interactive (CI/automated) environments, routing them safely instead of blocking. • Adds `NPQ_ALLOW_NON_INTERACTIVE_INSTALL=true` environment variable as an alternative to the CLI flag for authorizing non-interactive install routing in pipelines and scripts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.26.0 https://github.com/lirantal/npq/releases/tag/v3.26.0 Thu, 13 Aug 2026 07:53:09 GMT npq v3.26.0 expands coding-agent detection signals to better identify AI-assisted install environments. • Expands coding-agent detection signals to more accurately identify when npq is running inside an AI coding agent environment. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.25.0 https://github.com/lirantal/npq/releases/tag/v3.25.0 Mon, 10 Aug 2026 08:47:23 GMT npq v3.25.0 auto-detects coding-agent environments and switches output and parsing to JSON mode • Detects coding-agent environments automatically and defaults both audit output and package parsing to JSON mode when running inside one. • Defaults audit output to JSON format when a coding-agent environment is detected, enabling structured, machine-readable results without manual flags. • Defaults package parsers to JSON-safe mode in coding-agent environments, rejecting inputs like credential-bearing URLs that are unsafe to process as JSON. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.24.0 https://github.com/lirantal/npq/releases/tag/v3.24.0 Sun, 09 Aug 2026 12:38:41 GMT npq v3.24.0 adds a `--json` flag for non-interactive, machine-readable audit-only output • Adds `--json` CLI flag that emits a versioned JSON audit report and never proceeds to install, enabling CI and scripted pipelines to consume npq results programmatically. • Routes `--json` invocations to an audit-only output path, bypassing interactive prompts and auto-continue behaviour. • Captures and surfaces incomplete audit check results within the JSON report so callers can distinguish fully-evaluated from partially-evaluated signals. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.23.0 https://github.com/lirantal/npq/releases/tag/v3.23.0 Fri, 17 Jul 2026 11:40:37 GMT npq now suggests a proven-older semver when a package version fails the 30-day recency check. • Adds an alternative-version suggestion to version-maturity failures, surfacing the highest older semver published outside npq's 30-day recency window so practitioners have an actionable candidate to audit next. • Renders the suggestion in rich, plain, and JSON output without affecting issue counts, and suppresses it automatically for packages flagged as malicious. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.22.0 https://github.com/lirantal/npq/releases/tag/v3.22.0 Thu, 16 Jul 2026 21:38:26 GMT npq now corroborates expired-domain warnings with authoritative RDAP lookups to reduce false positives. • Adds RDAP corroboration for expired-domain warnings: a warning is only emitted when DNS returns NXDOMAIN *and* the authoritative RDAP service confirms no active registration, reducing false positives from DNS-only failures. • Routes RDAP lookups through the official IANA DNS bootstrap registry with HTTPS enforcement, 3-second timeouts, no redirects, and process-lifetime caching. • Reports inconclusive RDAP evidence (unsupported TLDs, timeouts, rate limits, multipart suffixes, malformed names) as 'not evaluated' rather than blocking installs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.21.0 https://github.com/lirantal/npq/releases/tag/v3.21.0 Sat, 11 Jul 2026 08:56:33 GMT npq v3.21.0 adds authenticated custom registry support, routing all audits through your configured npm registry. • Supports authenticated custom registries: reads standard npm registry configuration (auth, proxies, TLS, client certs) from `.npmrc` and routes all package metadata, manifest, signing-key, and attestation lookups through a shared authenticated registry client. • Adds `--registry`, `--userconfig`, and `--globalconfig` CLI flags to explicitly set the registry and npm config paths per invocation. • Reports signing, provenance, and download-count capabilities as `NOT EVALUATED` (rather than failures) when the selected registry does not expose those services. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.20.0 https://github.com/lirantal/npq/releases/tag/v3.20.0 Tue, 07 Jul 2026 07:31:53 GMT npq v3.20.0 refreshes its typosquatting detection dataset for more accurate supply-chain threat coverage. • Updates the typosquatting package dataset to replace stale entries, improving detection of malicious lookalike packages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.19.0 https://github.com/lirantal/npq/releases/tag/v3.19.0 Wed, 08 Apr 2026 18:25:15 GMT Adds `--dormant-maintainers` flag to detect dormant maintainers in npm packages. • Adds `--dormant-maintainers` flag to include maintainer dormancy signals in supply chain security checks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.17.0 https://github.com/lirantal/npq/releases/tag/v3.17.0 Tue, 07 Apr 2026 08:56:24 GMT npq v3.17.0 now exits with a non-zero status code when scanning finds issues • Adds non-zero exit codes when `npq` scan detects security or quality issues, enabling CI/CD blocking Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.16.0 https://github.com/lirantal/npq/releases/tag/v3.16.0 Sat, 20 Dec 2025 10:45:38 GMT npq v3.16.0 adds support for archived repositories as a signal source. • Adds `archived` repository state as an available signal source for npm package analysis. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.15.0 https://github.com/lirantal/npq/releases/tag/v3.15.0 Fri, 28 Nov 2025 20:29:50 GMT npq v3.15.0 adds `--no-continue` to disable auto-continue behavior • Adds the `--no-continue` flag to prevent automatic continuation after checking package outcomes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.14.0 https://github.com/lirantal/npq/releases/tag/v3.14.0 Thu, 30 Oct 2025 15:12:39 GMT Adds Snyk integration via new environment variables for API URL and token • Adds `SNYK_API_URL` and `SNYK_TOKEN` environment variables to configure custom Snyk endpoint and authentication Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.13.0 https://github.com/lirantal/npq/releases/tag/v3.13.0 Sat, 30 Aug 2025 12:35:15 GMT Unifies the internal marshalling logic for consistent result formatting in npq v3.13.0 • Unifies marshall result formatting Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.12.0 https://github.com/lirantal/npq/releases/tag/v3.12.0 Thu, 28 Aug 2025 18:01:59 GMT Improve CLI countdown UX with single-line display • Improve CLI countdown UX with single-line display Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.10.0 https://github.com/lirantal/npq/releases/tag/v3.10.0 Sun, 20 Jul 2025 17:08:22 GMT npq v3.10.0 adds env var support for the npq binary itself • Adds environment variable support to the `npq` binary (previously only available in `npq-hero`) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.9.0 https://github.com/lirantal/npq/releases/tag/v3.9.0 Thu, 10 Jul 2025 06:59:01 GMT npq v3.9.0 adds OSV fallback, --plain output, direct package scanning, and provenance warning updates • Add osv database as vulnerabilities fallback for enhanced detection coverage. • Support `--plain` output flag to disable colorful UI rendering. • Scan direct packages of project with new scanning depth capability. • Show category id in the output for better issue context. • Downgrade provenance checks to warnings to reduce noise. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.8.0 https://github.com/lirantal/npq/releases/tag/v3.8.0 Tue, 24 Jun 2025 07:26:42 GMT npq v3.8.0 adds `--version-pattern` flag to match generic version ranges in package checks • Adds `--version-pattern` CLI argument to enable matching generic versions during npm package checks Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.6.0 https://github.com/lirantal/npq/releases/tag/v3.6.0 Sat, 21 Jun 2025 17:52:44 GMT Adds `--version-maturity` flag to filter packages by npm version maturity (LTS, Maintenance, etc.) • Implements version maturity filtering via the new `--version-maturity` CLI flag Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.3.0 https://github.com/lirantal/npq/releases/tag/v3.3.0 Tue, 21 Nov 2023 13:22:15 GMT npq v3.3.0 adds new `--top` flag to download and distribute top packages for checks • Adds the `--top` flag to enable downloading and distributing top downloaded packages for checks Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.2.0 https://github.com/lirantal/npq/releases/tag/v3.2.0 Sat, 30 Sep 2023 13:47:20 GMT npq v3.2.0 revamps the package author check for potential compromise • Revamped package author check logic to better detect potential package compromise Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v3.1.0 https://github.com/lirantal/npq/releases/tag/v3.1.0 Fri, 29 Sep 2023 11:22:10 GMT npq v3.1.0 splits marshalls by categories. • Splits marshalls into separate categories to organize output or processing logic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v2.4.0 https://github.com/lirantal/npq/releases/tag/v2.4.0 Mon, 25 Sep 2023 14:27:43 GMT Adds signature marshalling to compare package signatures against repository keys • New marshall mode that compares package signatures with repository keys Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq https://github.com/lirantal/npq/releases/tag/v2.2.0 https://github.com/lirantal/npq/releases/tag/v2.2.0 Sun, 29 Jan 2023 18:29:49 GMT npq v2.2.0 adds support for npm install aliases • Adds `npm install` alias support to be compatible with commands Full history on Cyber Toolchain: https://cybertoolchain.io/tools/npq