6.7mediumCONDITIONAL GO

NPM Source Leak Scanner

A CI/CD tool that scans your published NPM packages for accidentally included source maps, secrets, internal paths, and debug artifacts before they go public.

DevToolsEngineering teams publishing NPM packages, especially those with proprietary ...
The Gap

Teams accidentally ship source maps, internal code, API keys, and debug files in their NPM packages — sometimes leaking proprietary source code to the public registry.

Solution

A pre-publish hook and CI integration that analyzes your package tarball against a ruleset: detects .map files, embedded secrets, internal file paths, debug configs, and over-broad file inclusions. Blocks publish and alerts the team.

Revenue Model

Freemium — free for open-source/individual use, paid tiers for team dashboards, policy enforcement, and Slack/PagerDuty alerts

Feasibility Scores
Pain Intensity7/10

The pain is real but infrequent — most teams don't know they've leaked until it's public and embarrassing. The Claude Code incident is a high-profile proof point, and the Reddit engagement (1,452 upvotes, 216 comments) shows developer awareness. However, this is a 'prevention' sell — teams don't feel the pain daily until the incident happens. Pain spikes to 10/10 post-incident but sits at 3/10 for teams who haven't been burned yet.

Market Size5/10

The total addressable market is narrow. Only teams that PUBLISH npm packages (not just consume them) are buyers. Estimated ~50,000-100,000 organizations actively publish to npm. At $50/month average, TAM is ~$30-60M/year. This is a solid niche but not a venture-scale market on its own. Could expand to PyPI, RubyGems, Maven, Docker Hub to 3-5x the market. As a standalone npm-only tool, this is a lifestyle business or acquisition target, not a unicorn.

Willingness to Pay5/10

Security tools have proven WTP in enterprise, but this is a narrow, preventive tool. Free alternatives (npm pack --dry-run, manual .npmignore review) exist even if they're inadequate. Many teams will just add a .npmignore and call it done after an incident. The paid tier needs to offer enough beyond what a well-configured .npmignore provides — team dashboards, policy enforcement, and Slack/PagerDuty alerts add value but may not justify $50+/seat/month for smaller teams. Enterprise security compliance requirements could drive larger deals.

Technical Feasibility9/10

Highly feasible for a solo dev MVP in 4-8 weeks. Core logic: run npm pack, extract tarball, scan contents against rules (regex for secrets, glob patterns for .map files, heuristics for internal paths/debug artifacts). npm-packlist provides the file list programmatically. Pre-publish hook is a well-documented npm lifecycle event. CI integration is straightforward (GitHub Action, GitLab CI template). No ML needed — rule-based scanning with configurable policies. The hardest part is reducing false positives on secret detection, but you can leverage existing regex patterns from GitGuardian/TruffleHog.

Competition Gap9/10

This is the strongest signal. NO existing tool specifically scans npm tarballs for the full spectrum of accidental leaks as a pre-publish gate. GitGuardian/TruffleHog only catch secrets (not source maps, paths, debug artifacts) and aren't npm-tarball-aware. Socket/Snyk scan inbound dependencies, not outbound publishes. publint checks structure, not security. The gap is wide, proven by a high-profile incident, and complementary to every existing tool in the space.

Recurring Potential7/10

CI/CD integration creates natural recurring usage — runs on every publish attempt. Team dashboards, audit logs, and policy enforcement justify subscription. However, churn risk is real: once a team configures their .npmignore properly, the tool may feel like insurance they can cancel. Need to continuously add value via updated rulesets, new leak pattern detection, compliance reporting, and multi-registry support to maintain stickiness.

Strengths
  • +Perfect origin story — Claude Code incident is a high-profile, memorable proof point that every JS developer knows about
  • +Zero direct competition — no existing tool covers outbound npm tarball scanning for the full leak spectrum
  • +Technically simple MVP — rule-based scanning on npm pack output, achievable by a solo dev in 4-6 weeks
  • +Complementary to existing security stack — not competing with Snyk/Socket/GitGuardian, fills their gap
  • +Natural CI/CD integration creates sticky, recurring usage pattern
  • +Open-source core strategy can drive adoption quickly in the npm community
Risks
  • !Narrow market — only npm package publishers, not all npm users. TAM ceiling without multi-registry expansion
  • !npm could build this in — a native npm publish --scan flag would kill the standalone market overnight
  • !Prevention tools are hard to sell — teams don't feel the pain until after an incident, then they just fix .npmignore
  • !Low switching cost — a well-maintained .npmignore + a simple shell script checking npm pack output covers 70% of the value
  • !Secret detection is commoditizing — GitGuardian or TruffleHog could trivially add an npm tarball scanning mode
  • !Risk of being a feature, not a product — could be absorbed by Socket.dev, Snyk, or GitHub as a minor feature addition
Competition
GitGuardian (ggshield)

Real-time secret detection platform that scans Git repositories and CI/CD pipelines for leaked credentials using 400+ detectors. Offers pre-commit hooks and public GitHub monitoring.

Pricing: Free for individuals, ~$40/dev/month for Teams, ~$50-60/dev/month for Business, Enterprise custom
Gap: Only detects credential-pattern secrets — completely blind to source maps, internal file paths, debug artifacts, and over-broad file inclusions. Scans Git repos, NOT npm tarballs. No awareness of npm packaging semantics (.npmignore, files field). Would NOT have caught the Claude Code source map leak.
TruffleHog

Open-source secret scanner that searches Git history, filesystems, S3 buckets, and other sources for credentials. Uniquely verifies found secrets are actually live by testing them against APIs.

Pricing: Free/open-source (OSS
Gap: No npm-tarball-aware scanning mode. Only finds secrets/credentials — does NOT detect source maps, internal paths, debug configs, or non-credential debug artifacts. No npm pre-publish hook. No understanding of npm packaging. Would need manual tarball extraction and still miss the majority of leak categories.
Socket.dev

Supply chain security platform that proactively detects malicious behavior in npm/PyPI/Go dependencies through behavioral analysis — detecting network access, obfuscated code, typosquatting in packages you consume.

Pricing: Free for open source, ~$100/seat/month for Teams, Enterprise custom. Raised $65M+ in funding.
Gap: Fundamentally different threat model — scans packages you CONSUME, not packages you PUBLISH. Zero pre-publish scanning capability. Cannot detect source maps, secrets, or debug artifacts in your own outbound packages. The entire 'outbound leak prevention' category is unaddressed.
Snyk

Developer security platform covering SCA

Pricing: Free for up to 5 users (limited tests
Gap: Does NOT inspect npm tarballs for accidental inclusions. No pre-publish scanning workflow. Secret detection is limited to source code SAST patterns — not npm-tarball-aware. Cannot detect source maps, internal paths, or debug artifacts. Not designed for the 'oops I published my entire source directory' scenario.
publint + Packwatch (OSS toolchain)

publint validates package.json correctness

Pricing: Free/open-source
Gap: publint only checks package structure, NOT security or content. Packwatch only tracks size — a small .env file or API key won't trigger alerts. Neither scans tarball contents for source maps, secrets, internal paths, or debug artifacts. No secret detection. No policy enforcement. No team dashboards or alerting. Would NOT have caught the Claude Code leak unless someone noticed the size delta.
MVP Suggestion

CLI tool + GitHub Action. Core: runs `npm pack`, extracts tarball, scans against built-in rules (source maps, common secret patterns, .env files, internal path heuristics, debug configs like .vscode/, .idea/). Outputs a clear pass/fail report with specific file-level findings. Ships as both an npm pre-publish hook (`npm pkg set scripts.prepublishOnly='npx leak-scan'`) and a GitHub Action. Open-source core with a managed cloud dashboard as the paid upgrade. Launch with a blog post referencing the Claude Code incident.

Monetization Path

Free OSS CLI (adoption driver) → Free GitHub Action with 50 scans/month → Pro at $19/month for unlimited scans + custom rules + Slack alerts → Team at $49/seat/month for org-wide policy enforcement, audit logs, dashboard, and PagerDuty integration → Enterprise at custom pricing for SSO, RBAC, compliance reporting, and multi-registry (PyPI, Maven, RubyGems) support

Time to Revenue

6-10 weeks to first dollar. Weeks 1-4: build CLI + GitHub Action, open-source it. Weeks 4-6: write launch blog post, post to Hacker News/Reddit referencing Claude Code incident, seed in npm community Discords. Weeks 6-8: launch free tier with usage limits. Weeks 8-10: introduce Pro tier for teams hitting limits. First paying customers likely from teams who recently had a leak incident and are searching for solutions.

What people are saying
  • Claude Code's source leaked via a map file in their NPM registry
  • What a week it's been. First Axios library vulnerability report and now this