Consider technology choices for npm-scanner

[virtualian]

Context

npm-scanner currently uses a mix of bash scripts and standalone Node.js files with a zero npm dependencies policy (to avoid supply chain risk from the very packages we're auditing).

Current Stack

Component	Technology	Notes
Main CLI	Bash	npm-scanner.sh
Scanning logic	Bash	audit-installed-packages.sh, npm-security-audit.sh
Shared library	Bash	npm-audit-lib.sh
Pre-install validator	Node.js	package-validator.js (no npm deps)
Data processing	jq, awk, sed, grep	Standard POSIX tools

External Dependencies

• node / npm - Required for package metadata
• jq - JSON parsing
• curl - HTTP requests
• unzip - Extract Tranco domain list (new)
• Standard POSIX: grep, awk, sed, sort, wc, etc.

Questions to Consider

1. Should we consolidate on one language?

   • All Node.js (still no npm deps) - better cross-platform, easier testing
   • All Bash - simpler but harder to maintain, bash 3 vs 4 issues

2. Is the zero-dependency policy the right tradeoff?

   • Pro: No supply chain risk from our own dependencies
   • Con: Limits tooling options, more code to maintain

3. How do we handle platform differences?

   • macOS bash 3.2 vs Linux bash 4+ (associative arrays)
   • unzip availability on minimal Docker images

4. Testing strategy

   • Currently: manual testing
   • Consider: automated tests (in what framework?)

Triggered By

Adding Tranco domain list download required unzip, prompting review of external dependencies.

---

Related to issue #6 (Enhance email risk assessment)