Sibyl

See what a script actually does before you run it.

npm install -g @mujib77/sibyl

---

The problem

You pull down a random script, install some npm package, or copy-paste code from a random gist. Before you run it, you have basically no idea what it's actually going to do. Will it phone home somewhere? Read your .env? Delete files? You just run it and hope.

What Sibyl does

Sibyl parses a JS/TS file into an AST (using Babel's parser, not regex) and walks it looking for the stuff that actually matters:

• Network calls (fetch, axios, request, etc.)
• File reads/writes/deletes
• Shell commands (exec, execSync, spawn)
• Environment variable access (process.env)
• eval() / Function() constructor usage

Then it gives you a clean report before you ever hit enter.

sibyl scan some-script.js

No config, no setup, just point it at a file.

Why AST parsing and not regex

Regex-based scanners break constantly — a package can wrap a dangerous call in a string, a template literal, whatever, and a regex just misses it or flags a comment that happens to contain the word "exec". Parsing the actual AST means Sibyl is looking at what the code is, not what it superficially looks like.

Usage

sibyl scan <file>

That's it right now. Point it at a file, get a report.

Roadmap

• Directory/project-wide scanning, not just single files
• Config file support (ignore rules, custom severity levels)
• npm install hook so it scans a package before it lands in node_modules
• GitHub Action for PR comments on new dependencies

Why I built this

I've been building CDC/database tooling in Go for a while (see Rift), and this is a bit of a detour into TypeScript - mostly because parsing JS is genuinely a much better fit for JS's own AST tooling than trying to do it from Go.

Still early, so if you scan something and Sibyl gets it wrong (misses something real, or flags something totally normal), open an issue. That's the fastest way this actually gets better.

License

MIT