Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/irchaosclub/FANGS/llms.txt

Use this file to discover all available pages before exploring further.

Running FANGS day-to-day centers on a tight loop: add packages you care about, watch for new releases that deviate from their baseline, decide whether each deviation is legitimate behavior or a threat, and teach FANGS to ignore recurring noise. The web UI at http://127.0.0.1:8443/ui/ mirrors the CLI exactly — both surfaces show the same underlying data, so you can use whichever fits your workflow.

​
The Core Workflow

1
Add a Package to the Watch List
2
Register a package with the watcher. FANGS validates the name against the npm registry, adds it to the watch list, and immediately queues a sandbox scan of the current latest version.
3
fangs package add axios
4
That first scan becomes the baseline — no deviations are possible because there is nothing to compare against yet. Every subsequent release is compared to this rolling baseline.
5
To queue a one-off scan for a specific version without adding it to the watcher:
6
fangs scan submit -package lodash -version 4.18.1
7
Check the Triage Queue
8
fangs pending shows every run that has at least one deviation and has not yet been promoted to baseline. Rows are sorted by maximum severity (descending), then by most-recently-detected.
9
fangs pending
10
SEVERITY  RUN          PACKAGE  VERSION  FINDINGS  DETECTED    PROMOTE
crit      18b1f8a3c2e1  axios    1.8.2    3         2m ago      fangs baseline promote 18b1f8a3c2e1
warn      9f4d2c8b1a70  chalk    5.4.0    1         14m ago     fangs baseline promote 9f4d2c8b1a70
11
Flags available on fangs pending:
12
FlagDescription-package PFilter to a single package-min-severity SShow only runs whose max severity ≥ S (low|medium|high|critical)-limit NCap the number of rows returned
13
Use the global -json flag before the subcommand to emit JSON instead of a table: fangs -json pending.
14
The PROMOTE column contains a ready-to-paste command. After reviewing a run, you can copy it directly from the terminal output.
15
Inspect Deviations
16
List all deviations across all packages, or narrow to a run or severity:
17
# All deviations
fangs deviation list

# Filter by package and severity
fangs deviation list -package axios -severity crit

# Filter by run
fangs deviation list -run-id 18b1f8a3c2e1
18
Show the full detail for a single deviation (including the raw evidence event):
19
fangs deviation show <deviation_id>
20
Deviation severity levels, from most to least severe:
21
LevelMeaningcritNetwork connections, DNS queries, TLS SNI contact, and new process executions — any unexpected external communication or executionwarn(same categories as crit; tuning alias reserved for future per-category weight adjustments)infoFilesystem path reads and writes outside known baseline locations
22
Promote a Clean Run
23
When you have reviewed the deviations for a run and determined the new behavior is legitimate — a library added a telemetry endpoint, changed CDN providers, started reading a new config path — promote the run:
24
fangs baseline promote 18b1f8a3c2e1
25
Promotion does three things:
26
  • Merges the run’s full fingerprint set into baseline_fingerprints (applying your current allowlists first, so suppressed values don’t get baked in).
  • Flips is_baseline = true on the run.
  • Clears the deviation rows for the run so the triage queue stays clean.
    • 27
    The next scan for this package will treat the promoted fingerprints as “known” and not flag them again.
    28
    The first run for a package auto-seeds the baseline — you never need to promote it manually. Any subsequent run that produces zero deviations is also automatically promoted. Manual promotion is only required when deviations exist.
    29
    Suppress Recurring Noise
    30
    If the same destination, path, or hostname keeps reappearing across multiple package releases and you’ve confirmed it is safe, add an allowlist rule instead of promoting every run individually:
    31
    # Suppress all connections into an internal CIDR (global)
fangs allow add -kind cidr -value 10.0.0.0/8 -note 'internal network'

# Suppress reads of a path prefix (global)
fangs allow add -kind path -value /usr/local/lib/ -note 'shared libs'

# Suppress a specific SNI for a single package
fangs allow add -kind sni -value telemetry.example.com -package axios -note 'axios telemetry'
    32
    See the Allowlists guide for full details on scoping and kind semantics.

    ​
    Run History

    View all runs across every package, or filter to one: 
    fangs run list
fangs run list -package chalk -limit 10
    Fetch the full detail for a specific run: 
    fangs run show <run_id>
    The table output includes the run state (pending → building → sandboxed → analyzed → done / failed), whether the run is part of the baseline, event counts, and timing.

    ​
    Reviewing the Baseline

    Inspect what the current baseline fingerprints contain for a package to understand what FANGS considers “normal” for it: 
    fangs baseline list -package axios

    CATEGORY               VALUE                          COUNT  FIRST_SEEN    LAST_SEEN
net_new_destination    104.16.0.0:443                 12     a1b2c3d4e5f6  9f4d2c8b1a70
fs_new_path_read       /usr/local/lib/node_modules/   8      a1b2c3d4e5f6  18b1f8a3c2e1
net_new_https_host     registry.npmjs.org             12     a1b2c3d4e5f6  9f4d2c8b1a70

    ​
    Package Management

    # List all packages with run summary counts
fangs package list

# List only watched packages (those receiving watcher polls)
fangs package watched

# Remove a package from the watcher (does not delete existing runs or baseline)
fangs package remove axios

    ​
    Web UI

    Every view described above is also available in the browser at http://127.0.0.1:8443/ui/. The pending queue, deviation list, run history, and baseline table all appear as the same data the CLI reads from the storage backend. The PROMOTE button in the UI fires the equivalent of fangs baseline promote without leaving the browser.

    Build docs developers (and LLMs) love

    Get started for freeTalk to us