Convert package-validator.js to Bash and deprecate npm-install-monitor.js

[virtualian]

Context

The codebase currently has two JavaScript files while everything else is Bash:

• scripts/package-validator.js - Pre-installation security check
• scripts/npm-install-monitor.js - Network monitoring during installation

This inconsistency creates:

• Mixed tooling and patterns
• Bash 3 vs 4 compatibility issues don't apply to JS, hiding problems
• Two languages to maintain

Proposal

1. Convert package-validator.js to Bash

The script uses only Node.js built-ins:

• https → curl
• fs → cat, file operations
• exec → direct bash commands
• Set/Map → associative arrays (bash 4+) or file-based lookups

All functionality can be replicated in Bash, consistent with the rest of the codebase.

2. Deprecate npm-install-monitor.js

This script monitors network activity during npm install. Consider:

• Is this functionality actively used?
• Does it provide value beyond what the scan commands offer?
• If valuable, convert to Bash; if not, deprecate

Benefits

• Single language (Bash) for all scripts
• Consistent patterns and error handling
• Easier to maintain
• Removes Node.js as implicit dependency for core functionality

Considerations

• Bash 4+ required for associative arrays (or use file-based approach for bash 3 compatibility)
• Test on both macOS (bash 3.2 default) and Linux (bash 4+)

Related

• Issue Consider technology choices for npm-scanner #34 (Consider technology choices for npm-scanner)
• PR Enhance email risk assessment (issue #6) #35 (Enhanced email risk assessment - added more JS code)