First install packages in a safe way, then use npm list and npm view to get the age of install packages.

Option 1: install with --ignore-scripts

npm i --ignore-scripts
npm list --depth=100 | awk '{ print $NF }'| tail -n +2 | grep -v "deduped" |  xargs -I {}  bash -c "npm view {} time.modified _id|tr '\n' ' ' && echo "|sort

Option 2: install in docker

docker run -v $PWD/package.json:/a/package.json -v $PWD/package-lock.json:/a/package-lock.json --rm -it node:lts-buster bash

cd a && npm i
npm list --depth=100 | awk '{ print $NF }'| tail -n +2 | grep -v "deduped" |  xargs -I {}  bash -c "npm view {} time.modified _id|tr '\n' ' ' && echo "|sort

explanation of the script, that prints the dates:

• npm list --depth=100 get list of installed packages
• | awk '{ print $NF }'extract the id of the package from each line
• | tail -n +2 drop first line, which refers to the current folder
• | grep -v "deduped" remove lines which refer to dupes
• | xargs -I {} bash -c for each line open subshell
• npm view {} time.modified _id get time and package-id
• |tr '\n' ' ' && echo remove line break between time and id, and add linebreak at the end
• |sort sort lines alphabetically

note: since npm view fetches 1 package at a time via network, the script takes about 1s per installed packages, which will add up to a couple of minutes for medium-sized projects.

To find out the malicious package, you will need a script that will check your package for vulnerabilities against national vulnerabilities database

The National Vulnerability Database includes databases of security checklist references, security related software flaws, misconfigurations, product names, and impact metrics.

Mostly all software companies use application security tools like Veracode, Snyk or Checkmarx that does this usually in a stage before deployment in the CICD pipeline.

If you're looking to achieve this locally, you can try

npm audit

But this will audit the installed dependencies and also its sub-dependencies in your project against the default registry (nexus or artifactory or npm registry) and gets you the list of known vulnerabilities with the version details in which patch is available.

npm view will get you the below details about the package even when it is not installed.

version checks before installing would need a script to do the necessary at preinstall, I would suggest to have a dedicated project for security checks (reusable for all projects), and link or publish it then configure that in your project scripts like below,

Security Project:

This will have the script to check for vulnerabilities, leverage npm view or npm version and audit the module then return the results.

Main project:

In here setup the scripts in package.json to use the above published project and check for vulnerabilities before installation.

npx security-project vulnerabilities


scripts: {
  vulnerability: npx security-project vulnerabilities
  preinstall: npx security-project vulnerabilities

  or

  preinstall: "sh ./checkVulnerabilities.sh" // this script can take package name through command line flags like --package axios
}

Snyk takes your package.json and will scan all the modules for security vulnerabilities. You could also search for specific module and check for a version's health score.

https://snyk.io/advisor/check/npm

Alternatively, you could use Snyk extension in your IDE for the same.

We have RetireJS chrome extension for scanning vulnerable JS module version with vulnerabilities in the application.

Good Ref:- 6-tools-you-can-use-to-check-for-vulnerabilities-in-node-js

Above are the ideas that I could think of, hope it helps.