trace-npm
Supply chain forensicsAlpha on npmnpm now asks you to approve install scripts. Nothing tells you what they do. trace-npm runs one under a syscall tracer and reports what it read, spawned and contacted — including the planted credential it took the bait on.
npx trace-npm run --package suspect --script postinstall
Does not establish that a package is safe. Evidence, not verdicts — and the report lists what it could not see.