check_maintainer_changes

io.github.salemalem/npmscan · Verify this server

Reconstruct who has controlled an npm package and when, straight from the packument (each version records the maintainer list at publish time and who ran `npm publish`). Use it for the 'who controls this package, and did that change recently' question; use get_package/check_package_provenance for general health and publish integrity. Flags: 1. a maintainer added recently who then published soon after, on a package with real prior history — the takeover shape behind ua-parser-js, event-stream and the 2025 chalk/debug ('qix') compromise 2. the whole maintainer list replaced at once 3. a long-standing maintainer quietly dropped 4. a maintainer change on npm AFTER the latest release — more urgent: access changed hands but nothing has shipped yet It also checks the declared GitHub repository: transferred or renamed (`repository.ownerLogin`/`ownerAvatarUrl` show the CURRENT owner), unreachable, or a latest release that landed long after any real push activity. If it flags a newly added or fully replaced maintainer, follow up with check_maintainer_blast_radius on that username to see whether the same account touched other packages at the same time. Findings are signals to verify, not proof of compromise.