nvm malware status
Show the local malware verdict for one or more package names.
The command reads malware.db, MalwareAllowList, and (Certified Builds) MalwareBlockList.
Use it to inspect the local lists before an install.
Usage
nvm malware status <module> [<module> ...] [flags]
Flags
| Flag | Description |
|---|---|
--json | Write one JSON array of verdict rows. |
Output
Three aligned columns. No header. Status is blocked or allowed.
left-pad blocked recognized as malware by OpenSSF
eslint allowed OpenSSF block overruled by malware acceptance policy
evil allowed Malware block overruled by module trust policy
[email protected] allowed OpenSSF block overruled by approved module policy
chalk allowed no malware detected
| Message | When |
|---|---|
| recognized as malware by OpenSSF | Name hits malware.db |
| blocked by organization malware policy | Certified Builds, local MalwareBlockList pattern |
| OpenSSF block overruled by malware acceptance policy | MalwareAllowList cleared an OpenSSF hit |
| OpenSSF block overruled by module trust policy | MalwareTrustConflict=continue and TrustedModules |
| Malware block overruled by module trust policy | same, for a local org-list hit |
| OpenSSF block overruled by approved module policy | continue and ApprovedModules |
| OpenSSF block overruled by approved global module policy | continue and ApprovedGlobalModules |
| malware checks skipped | skip_malware_checks is on |
| malware definitions are missing or invalid | malware.db missing or invalid |
| no malware detected | Name missed every list |
An allowed row with an "overruled" message still means OpenSSF (or the org list) hit. The named policy let it through.
--json uses status (allowed / blocked), message (same sentences), and source (OpenSSF, MalwareAllowList, TrustedModules, …).
MalwareAllowList wins if it also matches. If more than one grant matches, the source is TrustedModules, then ApprovedModules, then ApprovedGlobalModules.
Trusted or approved names follow MalwareTrustConflict. continue matches the shim: allowed plus the overruled message. prevent (default) still blocks.
Community Builds ignore MalwareBlockList.
Examples
nvm malware status left-pad
nvm malware status left-pad@1.0.0 eslint --json