Post

🧾 Introducing npm.tax Estimate the probability of being impacted by a breach in your npm supply chain. Adjust the knobs to see how slimming your node_modules lowers your risk. Look up a package to see its own risk profile, then share the report, e.g. npm.tax?direct=59&tr.... What's your npm tax?

npm.taxnpm.tax: npm supply-chain risk explorerExplore how your code, npm dependency count, breach probability, and time horizon combine into cumulative supply-chain risk.

2/8/26, 6:26 pm14 reposts78 likes

Marc Bernard

@marcf.be

2 Aug

Well, it’s should take known vulns into consideration. Take latest “next”. It looks very good on the “tax” (bcs of low number of deps). But it actually has 4 known vulns, 2 of them high!

Philippe Serhal

@philippeserhal.com

2 Aug

I could certainly clarify the wording, but npm.tax was intended to be about "npm supply-chain breaches" only, i.e. illicit versions of existing packages being published maliciously.