reddit · SideProject · 10-04 16:50 66 分 ← 返回列表

crypto dev, paranoid about my keys leaking, so I built a dependency scanner

I'm a crypto dev and I'm genuinely paranoid about my keys leaking. Not in the "use a hardware wallet" way, in the "some npm package I installed at 2am has a postinstall script that reads my .env" way. Which is a real thing now. The TanStack packages did exactly that, grabbed SSH keys and cloud creds and CI tokens. If you're a crypto dev, that's your deployer key and your RPC keys and whatever else is in that file. So I built a scanner. You POST a lockfile to /api/paid-scan, it downloads e

五维评分

付费意愿

需求真实度

个人可落地

竞争空间

新鲜度

AI 分析

痛点：npm 依赖的 postinstall/混淆代码可能窃取 .env、SSH、云凭证和加密钱包私钥，开发者尤其 crypto dev 缺乏低成本持续扫描手段。

目标用户：加密项目开发者、Web3 创业团队、持有部署密钥/RPC密钥的 Node.js 开发者

证据：I'm genuinely paranoid about my keys leaking... some npm package I installed at 2am has a postinstall script that reads my .env. ... If you're a crypto dev, that's your deployer key and your RPC keys ... So I built a scanner. You POST a lockfile to /api/paid-scan

变现：按次扫描付费、订阅制（私有项目/高频扫描）、团队席位费；共享缓存免费扫描可做增长，敏感包/新包扫描收费。

MVP：2周内做 CLI/GitHub Action：上传 package-lock.json，下载依赖并计算哈希，用规则+LLM 检查 postinstall、混淆、网络外联和敏感文件读取，输出风险报告；已扫描包走公共缓存，未命中收费。

竞品：Socket.dev、Snyk、Phylum、npm audit、GitHub Dependabot、Semgrep Supply Chain

摘要：一名 crypto dev 因担心 npm 包通过 postinstall 窃取 .env、SSH key、云凭证和部署私钥，做了一个依赖扫描器：上传 lockfile 后下载所有包并哈希文件，AI 检查未见过的包是否存在外传/混淆/postinstall 风险，已扫描文件免费，新文件走 /api/paid-scan。机会真实但竞争激烈，付费证据仅来自其收费端点设计，尚未看到收入或用户付费反馈。