dependency-auditor

Dependency auditing scans your npm, pip, and Go packages against known vulnerability databases to identify security risks. It checks package identity, install hooks, recency, and reputation to produce actionable findings and block conditions before installation.

Typosquatting detection identifies malicious packages with names similar to legitimate ones in your npm or pip dependencies. It prevents the installation of imposters by checking package identity and reputation during the security review module.

Yes, you can scan pip dependencies for malicious indicators before installation. The security review module checks for suspicious activity, unusual scripts, obfuscated code, and network activity to flag potential threats in your package installation flow.

Yes, the vulnerability scanner works with Go modules and npm packages. It audits these dependencies for known vulnerabilities, typosquatting, and malicious package indicators, providing a security review for your package installation flows across these ecosystems.

To block suspicious install hooks in npm dependencies, the auditor monitors unusual scripts and network activity during the package installation flow. It evaluates install hooks and severity levels to establish block conditions against identified malicious package indicators.

Auditing dependencies for security risks is limited to checking known vulnerabilities, typosquatting, and malicious indicators in npm, pip, and Go packages. It focuses on package identity and install hooks, and may not detect zero-day threats or novel obfuscated code.