July 25, 2026
The package gossip inspector
Pkgxray – inspect what gets installed, not what executes
This tool checks shady downloads before they move in, and the crowd is cheering and side-eyeing
TLDR: Pkgxray is a local safety checker that inspects downloads before installation and blocks obvious red flags without running them. People love the cautious, quarantine-first approach, but the comments are fighting over whether it’s a lifesaver or just another tool that says “maybe” a lot.
A new tool called Pkgxray has dropped with a very simple promise: check what a package wants to install before you let it anywhere near your machine. In plain English, it’s like a nosy bouncer for add-ons and downloads, especially the kind people hand over to AI coding helpers. It looks at the files, warning signs, and public package info, but crucially does not run the code while checking it. That detail had commenters instantly split into camps: one side called it “the smoke detector we should’ve had years ago,” while skeptics rolled their eyes and argued that bad actors can still hide the really nasty stuff until later.
The biggest applause came from people exhausted by sketchy install scripts and surprise behavior. The whole “quarantine first, promote later” flow had security-minded users practically doing victory laps, with many saying this is exactly the kind of boring, careful tool that becomes essential after the fifth ecosystem scare. But the drama kicked in fast: critics complained it may be too cautious, flagging things for human review instead of giving a clean yes-or-no. Others fired back that being annoying is the point when you’re one click away from installing something that reads secrets or phones home.
And yes, the jokes were immediate. Commenters compared it to an airport scanner for npm, a package TSA agent, and “that one friend who reads the terms and conditions so you don’t have to.” The running meme? “Not what executes” sounded to some like the most passive-aggressive tagline in software this week.
Key Points
- •Pkgxray is a local zero-dependency Node CLI and MCP server for assessing the safety of npm packages and AI coding-agent extensions before installation.
- •The tool returns three verdicts based on cited evidence from metadata and source text: safe, review, and block.
- •Its guard workflow stages packages in a private quarantine directory and does not run `npm install`, lifecycle scripts, build steps, or extension code.
- •For npm packages, pkgxray resolves registry metadata, queries OSV for exact-version vulnerabilities, blocks vulnerable packages before download, and otherwise audits the extracted tarball statically.
- •The article documents MCP tools, static detection heuristics, skipped file types, and a JSON schema compatibility guarantee with additive-only changes in the 0.x series.