skills.rest
makash
makashCOMMUNITY
Explore all skills by this author →
Website𝕏@makashGitHub

npm-supply-chain-response

Guide detection, containment, and remediation of npm supply chain incidents.

2|Updated Mar 26, 2026
Search Tags:#automation#npm#supply-chain#typosquatting#incident-response#iocs
One-click install
npx skills add https://github.com/makash/scira --skill npm-supply-chain-response
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: npm-supply-chain-response
Source: https://github.com/makash/scira/tree/main/bundled/npm-supply-chain-response
Command: npx skills add https://github.com/makash/scira --skill npm-supply-chain-response

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill helps teams triage, investigate, contain, and recover from npm supply chain incidents by guiding them through structured, repeatable workflows. It supports multiple output formats to fit different incident response needs, from quick guidance to complete runbooks.

Core Features & Use Cases

  • Interactive triage checklist that guides users phase by phase through detection, containment, and remediation.
  • Full incident response runbook suitable for sharing with security and engineering teams.
  • Shell script output option that automates detection, reporting, and evidence collection.

Quick Start

Ask for an interactive checklist, a full runbook, or an automation script to detect and respond to npm supply chain incidents.

Frequently Asked Questions about npm-supply-chain-response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is the best way to investigate a typosquatted npm dependency?▼

You can triage npm supply chain attacks by generating an interactive checklist, a full incident response runbook, or an automation script to guide your team through detection, containment, and remediation of compromised packages.

Do I need specific tools to run an npm supply chain incident response runbook?▼

Yes, you can request an automation script output to automatically detect npm postinstall backdoors, collect evidence, and report findings using Bash and Node.js, with optional support for tools like yarn, pnpm, jq, docker, and kubectl.

How do I check if my project is affected by a compromised npm package?▼

Yes, the npm supply chain triage process supports multiple package managers, requiring Bash and Node.js/npm while optionally integrating with yarn, pnpm, jq, docker, and kubectl for comprehensive incident containment and evidence collection.

What output formats can I use to triage npm supply chain incidents?▼

You can triage npm supply chain incidents using three output formats: an interactive triage checklist for phase-by-phase guidance, a full incident response runbook for team sharing, or a shell script for automated detection and reporting.

Related Skills

Explore More Software Engineering Skills→
bryanvillamilpragmabryanvillamilpragma
3

dependency-management

Audit npm, yarn, and pnpm dependencies for CVEs and license compliance.

Community
Advanced
YukiIto1999YukiIto1999

analyzing-docker-container-forensics

Analyze Docker container images, layers, volumes, logs, and runtime artifacts for malicious activity.

Community
Advanced
kalshamsikalshamsi
1

socket-sca

Scan npm and Python dependencies for supply-chain risks and map findings to CWE and OWASP Top 10:2021.

Community
Advanced
randalmurphalrandalmurphal

python-packaging

Manage Python dependencies and resolve version conflicts across Poetry, Pip, and uv workflows.

Community
Advanced