Legitimate, widely-used commander CLI library (v2.20.3) with no static findings, no suspicious files, and clean sandbox install.
AI breakdown
Plain-English summary of what this package does and how it behaves.
Commander is an npm package that provides a complete solution for building command-line programs in Node.js. Its main entry point is index.js with no runtime dependencies. Package scripts are limited to linting and testing.
Capabilities
- Parses command-line arguments for Node.js programs
- Defines CLI commands and options
Data access
- None observed
Network
- No network access observed
Widely used library for CLI argument handling with no dependencies or install-time scripts. Standard review of its index.js is still recommended before adoption.
Files in package (12)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/commander