Protect CI in 2 minutes

Your build fails the moment a hijacked npm version shows up in package-lock.json, and tells you which version to install instead.

Create the file .github/workflows/mene.yml in your repository and paste the workflow.
Commit it to your default branch.
Done. Every push and pull request is checked. A hijacked version fails the job.

.github/workflows/mene.yml

What a failing run looks like

This is a real run of the Action against the example project, a lockfile that installed the hijacked chalk and debug. The job fails and each hijacked package is annotated with its fix. See the run on GitHub →

✗ mene · chalk-attack · 2 errors

Error: debug@4.4.2 is flagged by MAL-2025-46974 (ACTIVE); use 4.4.1
Error: chalk@5.6.1 is flagged by MAL-2025-46969 (ACTIVE); use 5.6.0

The same run with a clean lockfile passes. The job summary lists the same packages as a table with their safe versions.

Run it in any project folder that has a package-lock.json. Nothing to install: npx fetches mene-check from npm.

terminal

npx mene-check check

Exit codes

Code	Meaning
`0`	Clean: no confirmed advisory matches the lockfile.
`1`	Hijacked packages found. The output lists each one and the safe version.
`2`	Couldn't verify (network down and nothing saved). Fails closed, so treat it as a failure.

Options

npx mene-check check --lockfile app/package-lock.json   # another lockfile
npx mene-check check --min-severity high                 # ignore low and moderate
npx mene-check check --json                              # machine-readable

--json prints the full result; the part most scripts need:

{
  "matches": [
    {
      "package": "debug",
      "installed": "4.4.2",
      "safeVersion": "4.4.1",
      "severity": "critical",
      "advisoryId": "MAL-2025-46974",
      "path": "node_modules/debug"
    }
  ],
  "source": "live"
}

Choose your own witnesses with a mene.config.json in the project; see the CLI docs or the npm page.

Any CI with Node.js 20 or later can run the CLI. Add a step that fails the job on a non-zero exit code.

GitLab CI

.gitlab-ci.yml

mene:
  image: node:22
  script:
    - npx --yes mene-check check

CircleCI, Jenkins, Buildkite and others

shell step

npx --yes mene-check check

Exit code 1 means a hijacked package was found and 2 means it couldn't verify; both should fail the build.