We’ve built an open-source tool, called Packj [1], to offer developers more insights into packages, such as risky install hooks, embedded binary blobs, and other malicious/risky packages. It performs static/dynamic/metadata analysis to look for "suspicious” attributes.