PumpCheck — catch a pumped npm dependency before it ships

A GitHub Action that scans the package.json files changed in a pull request for new or version-bumped dependencies, checks each one against PumpCheck's npm download-pumping detector, and posts the findings as a PR comment.

Download-pumping is a real supply-chain technique: hundreds of rapid-fire version publishes trick registry mirrors into inflating a package's reported download count, buying trust it never earned before someone adds it as a dependency. This catches it at the moment it matters — the PR that introduces the dependency — instead of after it's already in node_modules on every developer's machine.

If no package.json changed, or nothing in it is new or version-bumped, the action does nothing — no noise on unrelated PRs.

Usage

name: PumpCheck
on: pull_request

jobs:
  pumpcheck:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: mjaack/pumpcheck-action@v1

fetch-depth: 0 (or a value large enough to include the PR's base commit) is required — the action diffs against origin/<base-ref> to find which dependencies changed.

Inputs

Input	Default	Description
github-token	${{ github.token }}	Used to post/update the PR comment
api-url	https://www.edgethirteen.com/api/tools/pumpcheck/check	Scan endpoint
fail-on-inflated	false	Set true to fail the check run when any changed dependency comes back inflated
max-packages	20	Cap on how many changed dependencies to check per run

How it works

For each package.json changed in the PR, the action diffs dependencies and devDependencies against the base ref and collects any package name that's new or whose version string changed. Each one is checked, one at a time, against the free PumpCheck API — the same detector behind the public web tool: it compares npm's reported 30-day download count against a "sustained usage" estimate derived from version-publish cadence and per-day download concentration, and flags packages whose numbers only make sense if the count was artificially inflated.

Nothing about your source code is sent — only the package names already public in your (equally public, if the repo is public) manifest. Scoped to a per-package free check; the whole-manifest report with every dependency's full signal breakdown is the paid $299 audit.

License

MIT