Security in Ara is not a separate command you run after the fact. Every time you install a package — whether from the npm registry, a GitHub repository, or a local tarball — Ara scans its source files for dangerous patterns before unpacking anything to your project. If something suspicious turns up, Ara tells you immediately and lets you decide what to do. That decision happens in your terminal, not in a CI pipeline you configured months ago.Documentation Index
Fetch the complete documentation index at: https://mintlify.com/ara-home/ara/llms.txt
Use this file to discover all available pages before exploring further.
The install flow
When you runara install or ara add <package>, the following steps happen in order:
- Fetch — Ara downloads the package tarball from the appropriate source.
- Analyze — The security scanner walks every JS/TS source file in the package and runs it through a set of compiled regex patterns.
- Prompt — If any findings are detected, Ara shows them and asks whether to install, skip, or sandbox the package.
- Extract — Approved packages are unpacked to
node_modules/and stored in the content-addressable store.
Risk levels
Every finding is assigned one of four severity levels, ordered from most to least severe:| Level | Color | Meaning |
|---|---|---|
critical | 🔴 | Immediate code execution risk — eval(), new Function() |
high | 🟠 | Significant attack surface — shell execution, prototype pollution, native access |
medium | 🟡 | Suspicious but context-dependent — credential access, dynamic imports, weak crypto |
low | 🟢 | Informational — non-secure RNG, deprecated cipher APIs |
critical finding and three low findings is classified as critical.
Interactive mode vs CI
By default, Ara runs in interactive mode. When a package has findings, it pauses and shows a prompt:--non-interactive to install all packages silently. Findings are still logged but no prompt is shown:
In non-interactive mode, Ara installs all packages regardless of their risk level unless you configure a
risk_threshold in ara.toml. See the configuration section below.Standalone analysis commands
You can scan a package directory without installing anything using either of these commands:ara audit produces the same findings as ara analyze but uses a more detailed output format suitable for reports.
Configuring security thresholds
Ara reads security policy from the optional[security] section of ara.toml. You do not need this file for basic usage, but it lets you enforce stricter rules in projects where security is critical.
risk_threshold sets the minimum severity that triggers a prompt or blocks installation. The default effectively allows everything through in --non-interactive mode. Setting risk_threshold = "medium" means any package with a medium, high, or critical finding will be flagged.
require_review forces the interactive prompt for every package, even clean ones. Useful for auditing environments where human sign-off is required.
No lifecycle scripts
Unlike npm, Ara does not run package lifecycle scripts (preinstall, install, postinstall, prepare) at install time. This is an intentional security decision: lifecycle scripts are one of the most common vectors for supply-chain attacks because they execute arbitrary code on your machine the moment you install a package.
Instead, Ara flags any package that defines install scripts as a High severity finding so you can evaluate them manually before deciding to run them.