open-index/open-npm huggingface dataset:
npm package: @georgegiosue/pzx
Description: Find vulnerable npm packages
Latest version: 0.2.0

<div align="center">

# Package Zero-trust eXecute

**Secure Javascript Ecosystem supply chain. Advanced SCA and isolated runtime validation.**

[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
[![Bun](https://img.shields.io/badge/runtime-Bun-f9f1e1.svg)](https://bun.sh)
[![Zero Dependencies](https://img.shields.io/badge/dependencies-0-brightgreen.svg)]()
[![codecov](https://codecov.io/gh/georgegiosue/pzx/branch/master/graph/badge.svg)](https://codecov.io/gh/georgegiosue/pzx)

</div>

---

Scans your filesystem, resolves **real installed versions**, checks [OSV](https://osv.dev) for CVEs, runs supply chain heuristics, performs AST analysis with `Bun.Transpiler`, and detonates suspicious packages in a sandboxed environment. Zero dependencies.

## Usage

```bash
bunx @georgegiosue/pzx lodash
```

```bash
bunx @georgegiosue/pzx [package] [version] [--root <path>] [--home] [--lang <lang>] [--help]
```

```bash
bunx @georgegiosue/pzx                              # scan ALL installed packages
bunx @georgegiosue/pzx lodash 4.17.20               # check specific package
bunx @georgegiosue/pzx express --home               # scan from home directory
bunx @georgegiosue/pzx @babel/core -r ~/projects    # scan specific path
bunx @georgegiosue/pzx lodash --lang es             # output in Spanish
```

Without arguments, pzx enters **full scan mode**: discovers every installed package, runs static analysis locally, and only queries external APIs for packages flagged as suspicious.

## Analysis Engines

| Engine | What it does |
|--------|-------------|
| **OSV** | Checks installed versions against known CVEs |
| **Registry** | Detects abandonment, deprecation, quarantine, typosquatting |
| **Regex IoC** | `eval()`, `child_process`, base64, IP URLs, env exfiltration |
| **AST** | `Bun.Transpiler` import scanning for sensitive system modules |
| **Dep audit** | Random names, URL/IP/file versions in sub-dependencies |
| **Sandbox** | Detonates suspicious packages with intercepted `fetch`, `fs`, `exec` |

## Sandbox

Packages flagged by static analysis are executed in a controlled environment:

- **Mock environment** intercepts `fetch`, `fs`, `child_process`, `http/https`
- **Empty env** — no `AWS_SECRET_KEY`, no `NPM_TOKEN`, nothing to steal
- **1500ms timeout** — kills the process if it blocks (C2 wait, infinite loop)
- Violations are classified: `NETWORK`, `EXEC`, `FS_READ`

## Exit Codes

`0` no vulnerabilities | `1` error | `2` vulnerabilities found

## License

[MIT](LICENSE)
</div>

## Acknowledgements

*Most (if not all) of this was built by AI xd*
npm package: @georgelee31033/grglsum
Description: Một thư viện giúp bạn tính tổng của 2 số bất kỳ
Author: @georgelee31033
Latest version: 1.0.1

- Cài đặt nodejs và npm tại https://nodejs.org/en

- Tải file và lưu ở desktop

- Truy cập github.com tạo repository với tên tea-xyz-quest (Phải để repo public)

- Truy cập https://www.npmjs.com để tạo tài khoản

- Sửa file package.json, theo format
  - name => @username_npm/tea-xyz-quest 
  - author => @username_npm
  - repository => link tới repo github vừa tạo

- Truy cập repo github vừa tạo và upload cả folder vừa sửa lên Github

- Mở terminal, gõ lệnh "npm -v" để kiểm tra xem đã cài đặt thành công npm ở bước 1 chưa

- Gõ tiếp lệnh "cd Desktop/tea-xyz-quest" để trỏ tới thư mục code 

- "npm login" => Có 1 đường dẫn để bấm vào sẽ mở trình duyệt dẫn tới web login npm

- Sau khi login thành công gõ lệnh "npm publish --access public" để public package lên npm publish. 

- Truy cập app.tea.xyz => Register a New OSS Project

- Tìm kiếm tên package vừa tạo. . Bước này có thể mất tới 2-3 ngày để package mới xuất hiện trên hệ thống của tea.xyz

- Sau đó tea sẽ cho 1 file có tên tea.yaml, tải về và quay lại repo github, upload tiếp file đó lên là xong
npm package: @georgelee31033/grgltea
Description: A special Quest for tea.xyz
Author: @georgelee31033
Latest version: 1.0.0

- Cài đặt nodejs và npm tại https://nodejs.org/en

- Tải file và lưu ở desktop

- Truy cập github.com tạo repository với tên tea-xyz-quest (Phải để repo public)

- Truy cập https://www.npmjs.com để tạo tài khoản

- Sửa file package.json, theo format
  - name => @username_npm/tea-xyz-quest 
  - author => @username_npm
  - repository => link tới repo github vừa tạo

- Truy cập repo github vừa tạo và upload cả folder vừa sửa lên Github

- Mở terminal, gõ lệnh "npm -v" để kiểm tra xem đã cài đặt thành công npm ở bước 1 chưa

- Gõ tiếp lệnh "cd Desktop/tea-xyz-quest" để trỏ tới thư mục code 

- "npm login" => Có 1 đường dẫn để bấm vào sẽ mở trình duyệt dẫn tới web login npm

- Sau khi login thành công gõ lệnh "npm publish --access public" để public package lên npm publish. 

- Truy cập app.tea.xyz => Register a New OSS Project

- Tìm kiếm tên package vừa tạo. . Bước này có thể mất tới 2-3 ngày để package mới xuất hiện trên hệ thống của tea.xyz

- Sau đó tea sẽ cho 1 file có tên tea.yaml, tải về và quay lại repo github, upload tiếp file đó lên là xong
npm package: @georgeluo/metrics-ui
Description: Metrics UI server and dashboard for SimEval captures, streaming playback, and derivations.
Latest version: 0.1.3

# @georgeluo/metrics-ui

Metrics UI server and dashboard for SimEval captures, live file streams, derivations, and visualization plugins.

## Install

```bash
npm install -g @georgeluo/metrics-ui
```

## Run

```bash
metrics-ui serve --host 127.0.0.1 --port 5050
```

Optional storage paths:

```bash
metrics-ui serve \
  --data-root /path/to/metrics-ui \
  --upload-root /path/to/metrics-ui/uploads \
  --capture-sources-file /path/to/metrics-ui/capture-sources.json \
  --dashboard-state-file /path/to/metrics-ui/dashboard-state.json
```

Then open:

- `http://127.0.0.1:5050`
- WebSocket control: `ws://127.0.0.1:5050/ws/control`

## Docs

See [USAGE.md](./USAGE.md) for HTTP/WS protocol details and example automation flows.
npm package: @georgemiao/qbit.js
Description: a qBittorrent library made with typescript
Author: Antti
Latest version: 2.1.1

# qBit.js

A qBittorrent library made with TypeScript.  
Aiming to support the latest API version (at the time of writing v2.8.5).  
Currently just a API wrapper, planning to be a proper client.  
Only supports ESM, go away with your CJS.  
Proper documentation is on the todo.
npm package: @georgenet/dirls
Description: Get contents of a directory
Author: George Bougakov
Latest version: 1.0.1

## dirls - Get directory contents and metadata
[![Build Status](https://travis-ci.com/gbougakov/dirls.svg?branch=master)](https://travis-ci.com/gbougakov/jebase)
### Install
```bash
npm i @georgenet/dirls
```

### Usage
```js
const dirls = require('@georgenet/dirls')
console.log(dirls('path'))
```
Out:
```js
[
	{
		name: "file.txt" // File name
		type: "file" // Can be 'device', 'directory', 'FIFOpipe', 'file', 'socket', 'symlink' or 'unknown'
		stats: {} // fs.Stats object
	}
]
```
npm package: @georgenet/timeslotter
Description: Time slot generation library
Author: George Bougakov
Latest version: 1.0.3

# `timeslotter`

> Time slot generation library

## Usage

```js
const { generateTimeSlots } = require("@georgenet/timeslotter");

const slots = generateTimeSlots(
  "2020-10-30T12:00:00Z",
  "2020-10-30T17:00:00Z",
  60,
  45,
  [{ start: "2020-10-30T13:00:00Z", end: "2020-10-30T14:00:00Z" }]
);
```

### Explanation
The code above generates these time slots

![](explanation.png)

## Reference
Available in JSDoc format in `index.js` and as TypeScript typings in `index.d.ts`
npm package: @georgeroman/balancer-v2-pools
Description: <div align="center">   <h2><code>balancer-v2-pools</code></h2> </div>
Author: George Roman
Latest version: 0.0.14

<div align="center">
  <h2><code>balancer-v2-pools</code></h2>
</div>

<br/>

Simple SDK for simulating the exact on-chain behaviour of various Balancer v2 pools.

[![NPM](https://nodei.co/npm/@georgeroman/balancer-v2-pools.png?mini=true)](https://www.npmjs.com/package/@georgeroman/balancer-v2-pools)

### Install instructions

The SDK tries to be as lean as possible in order to prioritize certain critical usages (such as Balancer's SOR). For this reason, it only provides the bare-minimum for simulating Balancer pools off-chain. However, higher-level constructs (like initializing pools directly from on-chain data or the official Balancer subgraph) are still available. In order to be able to use these, make sure to install any peer dependencies of this package (eg. via [npm-install-peers](https://www.npmjs.com/package/npm-install-peers)).

### Usage instructions

```typescript
import { JsonRpcProvider } from "@ethersproject/providers";
import { WeightedPool } from "@georgeroman/balancer-v2-pools";
import { initFromOnchain } from "@georgeroman/balancer-v2-pools/dist/src/initializers/weighted";

const provider = new JsonRpcProvider(process.env.RPC_ENDPOINT);

// WETH/DAI 60/40 on Mainnet
const pool = await initFromOnchain(
  provider,
  "0x0b09dea16768f0799065c475be02919503cb2a3500020000000000000000001a",
  "mainnet"
);

// Swap
const amountOut = pool.swapGivenIn("WETH", "DAI", "100");

// Join
const bptOut = pool.joinExactTokensInForBptOut({
  WETH: "1",
  DAI: "2000",
});

// Exit
const tokensOut = pool.exitExactBptInForTokensOut("1.23");
```

### Setup instructions

Mainnet forking is used for testing in order to make sure the SDK exactly match the EVM. Make sure to have a `.env` file in the root directory, containing the following definitions (the given block number must include the instances of the pools used in the tests):

```bash
RPC_URL=
BLOCK_NUMBER=
```

The setup I recommend for deterministic tests is the following:

```bash
RPC_URL=https://eth-mainnet.alchemyapi.io/v2/${ALCHEMY_KEY}
BLOCK_NUMBER=13128465
```

To execute the tests locally, simply run:

```bash
# Install dependencies
npm install

# Run tests
npm test
```
npm package: @georgeroman/evm-tx-simulator
Description: Simulate any potential EVM transaction
Author: George Roman
Latest version: 0.0.48

# `evm-tx-simulator`

Simulate balance changes (`ETH`, `ERC20`, `ERC721` and `ERC1155`) resulted from running any potential EVM transaction.

Run via `npx ts-node ./src/index.ts` (see below an example output).

```json
{
  "0x0cccd55a5ac261ea29136831eeaa93bfe07f5db6": {
    "tokenBalanceState": {
      "native:0x0000000000000000000000000000000000000000": "-990000000000000",
      "erc721:0x57f1887a8bf19b14fc0df6fd9b2acc9af147ea85:10530676464258429157976288980766951099646391566276924398001212535050412393470": "1"
    }
  },
  "0x845bd54015813fda33f11e1f261ebc360983e584": {
    "tokenBalanceState": {
      "native:0x0000000000000000000000000000000000000000": "965250000000000",
      "erc721:0x57f1887a8bf19b14fc0df6fd9b2acc9af147ea85:10530676464258429157976288980766951099646391566276924398001212535050412393470": "-1"
    }
  },
  "0x8de9c5a032463c561423387a9648c5c7bcc5bc90": {
    "tokenBalanceState": {
      "native:0x0000000000000000000000000000000000000000": "24750000000000"
    }
  }
}
```
npm package: @georgeroman/wyvern-v2-sdk
Description: Wyvern V2 SDK
Latest version: 0.0.32

# Reservoir Wyvern V2 SDK

This repository contains an SDK for interacting with instances of Wyvern V2 contracts (including OpenSea).

### Build and test

This package doesn't have tests on its own, but it relies on the `core` package for testing (which makes intensive use of this SDK for easily interacting with Wyvern V2 instances during tests).

### Usage

```typescript
import { Builders, Helpers, Order } from "@georgeroman/wyvern-v2-sdk";

// Create an unsigned sell order
let sellOrder: Order = Builders.Erc721.SingleItem.sell({
  exchange: exchange.address,
  maker: seller.address,
  target: erc721.address,
  tokenId: "0",
  paymentToken: AddressZero,
  basePrice: parseEther("1").toString(),
  fee: "250",
  feeRecipient: feeRecipient.address,
  listingTime: (Math.floor(Date.now() / 1000) - 300).toString(),
  expirationTime: "0",
  salt: "0",
});
// Sign the sell order
sellOrder = await Helpers.Order.sign(seller, sellOrder);

// Create a matching buy order for the sell order
const buyOrder: Order = Builders.Erc721.SingleItem.matchingBuy(
  buyer.address,
  sellOrder
);

// Trigger settlement
await Helpers.Wyvern.match(buyer, buyOrder, sellOrder);
```
npm package: @georges-tech/rollup-dev-server
Description: Launches Rollup Dev Server for Component Testing
Author: Mathieu Stanowski
Latest version: 1.0.1

# @georges-tech/rollup-dev-server

> **Note** this package is not meant to be used outside of cypress component testing.

Install `@cypress/vue` or `@cypress/react` to get this package working properly

To install `@georges-tech/rollup-dev-server` in you component testing environment,
1. Install it `yarn add @georges-tech/rollup-dev-server`
2. Add it to `cypress/plugins/index.js`

```js
import { startDevServer } from '@georges-tech/rollup-dev-server'

module.exports = (on, config) => {
  on('dev-server:start', async (options) => startDevServer({ options }))

  return config
}
```

## API

`startDevServer` takes an object of options.

- `options` (required): this contains various internal configuration. It's provided as the first argument to the `dev-server:start` event. Just make sure you pass it to the `startDevServer`.
- `rollupConfig` (optional): the rollup config used by your application.

## Tests

Rollup-dev-server integrate a cypress configuration for testing this package.

Cypress folder contains :
- **components**: Test files
- **support**: Those files will be loaded in cypress environment
- **plugins.js**: Required to start dev server

You can find a default `rollup.config.js` for typescript: [here](./rollup.config.js).

After installing dependencies with `yarn install`, you need to build project with `yarn build`.
Then, you can start cypress test by using :

- `yarn cy:open` will open a chrome browser to test and see results.
- `yarn cy:run` will execute tests inside your terminal.


## Changelog

[Changelog](./CHANGELOG.md)