tarsenTarsen checks executable npm packages before developers or AI agents run them.
$ tarsen check create-random-app
Fetching package metadata...
✓ Analyzed 132 files
Package create-random-app@2.0.1
Published 2 days ago
Maintainers unknown
! postinstall script detected
! child_process usage detected
! process.env access detected
! network access detected
Risk HIGH
Decision ASK USER BEFORE RUNNING
? Proceed with npx? no
Inspect package code without executing it.
See scripts, network, filesystem and env access.
Run only after a clear, explicit decision.
Running an unfamiliar package can expose your files, environment variables, network, and shell before you know what the package intends to do. The usual install prompt gives you almost no useful context.
Tarsen downloads the tarball into a temporary directory, analyzes it without executing package code, explains the signals, and asks before handing the command to npx. Humans get a readable report; agents get strict JSON.
Install tarsen-cli globally and use the shorter tarsen command anywhere. npm, pnpm, Yarn, and Bun all resolve the same package from the public npm Registry.
npm install --global tarsen-clipnpm add --global tarsen-cliyarn global add tarsen-clibun add --global tarsen-clinpx tarsen-cli check reactpnpm dlx tarsen-cli check reactyarn dlx tarsen-cli check reactbunx tarsen-cli check reactThe script detects npm, pnpm, Yarn, or Bun already installed on your machine.
curl -fsSL https://raw.githubusercontent.com/pandapor/tarsen/main/install.sh | shtarsen check reacttarsen check react --jsontarsen run create-next-app my-app$ tarsen check create-random-app
Fetching package metadata...
✓ Analyzed 132 files
Package create-random-app@2.0.1
Published 2 days ago
Maintainers unknown
! postinstall script detected
! child_process usage detected
! process.env access detected
! network access detected
Risk HIGH
Decision ASK USER BEFORE RUNNING
Use tarsen check package --json to get structured risk, signals, and a recommendation before any executable package runs.