example-stealer example
Recognised attack techniqueEditor / AI-agent hook persistence Dead-drop / C2 relay
See what your npm dependencies actually do — at runtime.
Static scanners tell you a package is known bad. dephawk watches what a dependency actually does when it runs — reads your secrets, reaches the network, spawns a shell, plants an editor/AI-agent hook — and names the technique. It runs in your terminal, your CI, and inside your AI coding agent.
npm i -D dephawknpx dephawk x <package> # audit one packageThree ways to run it
In CI
Watch every npm ci in the repo. Two lines in your workflow; findings land in the job summary, and it can fail the build on a blocked call.
dephawk x <pkg>
Vet a single dependency in a throwaway sandbox before you trust it. See exactly what it reaches for.
Your AI agent (MCP)
So Claude Code / Cursor can check what the packages they install actually do — and block unmonitored installs automatically. Setup ↓
Use it inside your AI agent (MCP)
AI coding agents install and run npm packages without anyone reading them — the exact blind spot the 2026 worms use. dephawk plugs into the agent so it can check first.
1 · Claude Code
claude mcp add dephawk -- npx -y dephawk mcp1 · Cursor / Windsurf (mcp.json)
{
"mcpServers": {
"dephawk": { "command": "npx", "args": ["-y", "dephawk", "mcp"] }
}
}2 · Make it automatic
dephawk hooks installRoutes the agent's npm install / ci through dephawk automatically — no need to remember to ask.
The agent then has three tools: audit_package (vet a package before adding it), audit_command (what did this install/build do?), and list_attack_techniques (explain a finding).
Recently examined
Each package installed in a sandbox and run under dephawk. See all →