Verify an npm package's publisher and source before running npx
You will check who publishes an npm package and where its source lives before running it with npx. This takes a few minutes and lowers the chance of running a look-alike or mislabeled package.
- Find the upstream repoStart from the GitHub project, not a copied command
- Search npm by exact nameType the package name yourself
- Compare publisher and repoMaintainers and repository field should match the project
- Pin a version and runLimit access and avoid floating latest
Why it matters
The UI-TARS-desktop directory entry tells you to run npx -y UI-TARS-desktop and then points to a different npm page, @agent-infra/mcp-server-browser, for "official instructions." Two names in one setup note is exactly the kind of gap where you can end up executing the wrong code. The same listing also flags supply-chain dependency as a risk for ByteDance-maintained infrastructure, so it is worth confirming the source yourself. See the project on GitHub (opens external site) for the upstream repository.
Steps
- Open the GitHub repository linked from the directory page and read its README. Note the package names it lists for installation.
- Search npm for the exact package name you plan to run. Do not rely on a link alone; type the name yourself in the npm search or on the npm website.
- On the npm package page, check the publisher name and the maintainers list. Confirm they match the organization that owns the GitHub repository.
- Check that the package page links back to the same repository URL. A mismatch between the npm repository field and the GitHub project is a reason to stop.
- Look at the version history and the publish date of the version you plan to run. A brand-new package with a famous name deserves extra scrutiny.
- Once you are satisfied, run the package with a specific version pinned instead of the latest tag, so a later publish cannot change what you run.
- Run it with the least access you need. Keep it away from directories holding credentials, and do not paste API keys or session cookies into the setup until you know what the tool does with them.
Common mistakes
- Running
npx -yimmediately after copying a command from a listing, without opening the npm page first. - Trusting a package because its name looks like the project name. Names can be similar but owned by someone else.
- Assuming the GitHub link and the npm package are the same thing without comparing their repository fields.
- Using the
latestversion by default, which lets future releases change what runs on your machine.
Checklist
0 of 8 done