pest-control - A zero-dependency, cross-platform CLI to extermina

项目说明

<di="center">

<pre style="margin:0 auto; display:inline-block; text-align:center;"><code>
██████╗ ███████╗███████╗████████╗ ██████╗██████╗ ██████╗
██╔══██╗██╔════╝██╔════╝╚══██╔══╝ ██╔════╝██╔══██╗██╔══██╗
██████╔╝█████╗ ███████╗ ██║ ██║ ██████╔╝██████╔╝
██╔═══╝ ██╔══╝ ╚════██║ ██║ ██║ ██╔══██╗██╔═══╝
██║ ███████╗███████║ ██║ ╚██████╗██║ ██║██║
╚═╝ ╚══════╝╚══════╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚═╝

💀 NPM Malware Extermination Tool v1.1.9
BATTLE-TESTED • ENTERPRISE-GRADE • BOT-RESISTANT
AUTHENTIC SECURITY TOOL - INTEGRITY
</code></pre>

![npm ]()
![License]()
![Downloads]()

![GitHub Ad]()
![Socket.de]()

<div>
<a href=" GitHub Ad</a>
•
<a href="

</div>

<p align="center">
<img src="assets/pest-control-icon.svg" alt="Pest Control icon" width="56" height="56" />
</p>

</div>

---

Pest Control - NPM Malware Exterminator

⚡ Quick Start

1. Run in your project root:

2. The tool will scan, clean, and enforce safe automatically.
3. Reinstall dependencies with your package manager:

No configuration, no secrets, zero dependencies required.

---

🚀 Installation

Using npx (Recommended)

One of History's Biggest Supply-Chain Attacks — O

What You Need to Know

> WARNING: The npm ecosystem is under attack! Malicious of widely-used color utilities have been detected:

| Package | Status | Impact |
|---------|--------|--------|
| ansi-regex | ⚠️ Compromised | Critical |
| ansi-styles | ⚠️ Compromised | Critical |
| color-name | ⚠️ At Risk | High |
| color-convert | ⚠️ At Risk | High |
| color-string | ⚠️ At Risk | High |

> 💡 Note: These packages are used by thousands of projects and their dependencies. Even if you don't use them directly, your project might be at risk!

These exfiltrate secrets (env vars, CI tokens) and can persist deps and lockfiles.

✅ Protected Packages & Safe

The CLI enforces the following safe in your project (via npm o, Yarn resolutions, and pnpm pnpm.o). These are client-side safe pins only — no backend internals are exposed.

| Package | Safe |
|---------|--------------|
| ansi-regex | 5.0.1 |
| ansi-styles | 4.3.0 |
| color-name | 1.1.3 |
| color-convert | 1.9.3 |
| color-string | 1.6.0 |
| is-arrayish | 0.2.1 |
| simple-swizzle | 0.2.1 |
| supports-color | 7.2.0 |

These pins are applied automatically and kept in sync across npm, Yarn, and pnpm to prevent compromised from entering your dependency tree.

🔎 Identify Legit /Hijacked Packages

Use these quick checks before trusting or upgrading a package:

Maintainers and org ownership

- the maintainer list and scope ownership.

Repository and homepage legitimacy

- Check that the repository.url and homepage match the real project.

timeline anomalies

- Look for sudden jumps or bursts of releases.

Dist-tags and downloads sanity

- Confirm latest points to the expected ; look for unusual download spikes.

Tarball integrity and contents

- Inspect the package tarball when in doubt.

Supply‑chain hardening when in

- Avoid running lifecycle scripts while inspecting:

Pin exact safe

- Lock to known‑good with o/resolutions (this tool automates that):

If any check looks suspicious (maintainers changed, repo mismatch, unexpected dist-tag, sudden surge), pause upgrades and pin to the last known safe until .

🛡️ 8-Phase Security Protocol

<di="center">
<img src=" />
<img src=" />
<img src=" />
<img src=" />
<br/>
<img src=" />
<img src=" />
<img src=" />
<img src=" />
</div>

1. 🔍 SCAN

> *Comprehensive deep scan with strict *
> Scans node_modules (including nested dependencies) for known malicious packages and suspicious patterns.

2. 💀 EXTERMINATE

> *Removal of detected threats*
> Automatically uninstalls all identified malicious packages and their .

3. 🔥 FIRE BLAZE

> *Complete node_modules purge*
> Nuclear option: Removes the entire node_modules directory to ensure no traces remain.

4. 🥚 COCKROACH EGGS

> *Lockfile annihilation*
> Removes all lockfiles to prevent dependency confusion attacks:
> - package-lock.json
> - yarn.lock
> - pnpm-lock.yaml
> - npm-shrinkwrap.json

5. 🛡️ SHIELD

> *Proacti*
> Applies o in package.json based on your package manager:
>
> - npm: Uses o
> - Yarn: Uses resolutions
> - pnpm: Uses pnpm.o

6. 🔄 REBUILD

> *Secure dependency installation*
> Reinstalls all dependencies with progress indicators and blacklisting of known malicious packages.

7. ✅

> *Final security audit*
> Performs a final scan to ensure all threats are eliminated and provides a detailed security report.

8. 📜 CERTIFY

> *Documentation and *
> Generates a SECURITY_CERTIFICATE.txt with:
> - Scan results
> - Actions taken
> - Recommended next steps
> - Package manager specific lockfile

🚦 Usage

Basic Usage

Ad Options

CI/CD Integration

> 💡 Tip: The tool runs fully unattended with real-time progress indicators and phase labels, ensuring it ne frozen.

🟢 When Nothing Is Detected

You’ll see “No malware detected.” Pest Control still performs full cleanup (including precautionary lockfile removal and secure reinstall) to eliminate any chance of undetected persistence.

Enforcement Across Package Managers

npm — package.json#o and a gated preinstall that runs npm-force-resolutions only for npm

Yarn — package.json#resolutions is added so Yarn enforces the same safe

pnpm — package.json#pnpm.o pins safe

After success, the lockfile is regenerated for your detected package manager

🧠 Ad Users: In-Depth (Optional)

> Disclaimer: Broad ecosystem scans can miss localized or repackaged threats. If you suspect compromise, at the file/directory level. These checks are optional and safe to run.

1) List families present (tree view)

2) pinned in metadata and lockfiles

3) Search node_modules for suspicious exfiltration patterns

4) Inspect a specific tarball before trusting it

5) Install for analysis only (no scripts)

If any result looks suspicious (unexpected network calls, credential headers, or unrecognized maintainers), pause upgrades and pin to the last known safe . Then run this tool’s cleanup again.

Certification Outputs

package.json: a pestControl block with certificate ID, timestamp, and status

package-lock.json: a pestControl block reflecting enforced safe (npm)

SECURITY_CERTIFICATE.txt: human-readable certificate summary

Social Preview (Sharing)

To get a clean preview card when sharing the repo:

1. Open your repo page on GitHub.
2. Go to Settings > General > Social preview.
3. Upload assets/social-preview.svg (or the exported PNG if GitHub requires it).
4. Sa will use this image for link previews.

Why Trust This?

Zero Dependencies — Native Node.js only

Transparent — Simple, readable code

Safe Defaults — Focused file ops with clear logs and backups regen

Community-driven. Use at your own risk. Issues and PRs welcome.

Key Features

Lightning-fast, zero-dependency Node.js CLI (no install required via npx)

Full 8-phase cleanup for ansi-regex and related supply-chain malware

Cross-PM enforcement: npm o, Yarn resolutions, pnpm pnpm.o

npm-only preinstall guard: npx --yes npm-force-resolutions (auto-skips Yarn/pnpm)

Precautionary lockfile removal + PM-aware lockfile regeneration

Persistent spinners with phase labels so the CLI ne frozen

Final certification: SECURITY_CERTIFICATE.txt and metadata in JSON files

Windows, macOS, and Linux support (CMD/PowerShell/Bash)

Supported Package Managers & Platforms

npm (o, gated preinstall guard, package-lock regeneration)

Yarn (resolutions, yarn.lock re-resolution)

pnpm (pnpm.o, pnpm-lock.yaml regeneration)

Operating systems: Windows, macOS, Linux

CI/CD Integration

Add a pre-step to run Pest Control in your pipeline before install/build:

For npm users, the tool also injects a gated preinstall script that runs npm-force-resolutions only when the user agent is npm, ensuring lockfile alignment prior to npm install.

Troubleshooting

Spinner looks static in logs: spinners update the same line; the CLI is active. You can increase by running in a local terminal.

Lockfile regen fails (missing PM): The tool continues and logs a warning. Install the respective PM and rerun Pest Control.

"Unknown " warnings: The package is not in the known safe/malware list; o keep you safe, but consider auditing that package.

FAQ

Does this delete my code?

No. It deletes node_modules and lockfiles, then applies safe o/resolutions, and performs a clean reinstall.

Why remo even when nothing is detected?

Lockfiles can preser dependency trees. We remove them as a precaution and then regenerate with shields enforced.

Will this break Yarn or pnpm?

No. The npm preinstall guard is gated to npm user agents. Yarn/pnpm users get nati via resolutions/pnpm.o without the preinstall step.

Can I run it on CI safely?

Yes. It is zero-dependency and uses native Node modules. Add npx pest-control before your install.

Keywords (SEO)

ansi-regex malware removal, npm supply chain attack cleanup, remo npm package, npm o safe , Yarn resolutions security, pnpm o malware, delete lockfile package-lock yarn.lock pnpm-lock, node_modules cleanup, npx security tool, Windows macOS Linux CLI, npm-force-resolutions preinstall, secure reinstall, malware exfiltration pre

项目信息

开发语言：JavaScript

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A zero-dependency, cross-platform CLI to exterminate the ansi-regex supply-chain attack and related variants.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。