skills.rest
neuron-one
neuron-oneCOMMUNITY
Explore all skills by this author →
GitHub

supply-chain

Audit npm and PyPI dependencies for CVEs, typosquatting, and lockfile integrity.

25|10|Updated Apr 1, 2026
Search Tags:#security#vulnerability#npm#pip#auditing#typosquatting#dependency
One-click install
npx skills add https://github.com/neuron-one/GODMODE --skill supply-chain-neuron-one
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain
Source: https://github.com/neuron-one/GODMODE/tree/main/skills/security/supply-chain
Command: npx skills add https://github.com/neuron-one/GODMODE --skill supply-chain-neuron-one

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Checks npm/pip dependencies for known vulnerabilities, typosquatting, and malicious packages. Use before adding new dependencies or during security audits. Don't use for runtime monitoring.

Core Features & Use Cases

  • Dependency auditing: identify CVEs, deprecated or unmaintained packages, and license concerns.
  • Typosquatting checks: catch close-name attacks before installation.
  • Lockfile integrity: verify consistency and safe upgrades during audits.

Quick Start

Run the supply-chain skill to audit your project's dependencies before adding them to your codebase.

Frequently Asked Questions about supply-chain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit npm and pip dependencies for known vulnerabilities before adding them?▼

To check for typosquatting in npm and PyPI packages, you can run a dependency audit that catches close-name attacks before installation. It verifies lockfile integrity and flags malicious packages attempting to mimic legitimate ones.

Does dependency auditing verify lockfile integrity during security reviews?▼

You should use dependency auditing when adding new dependencies or conducting security audits of existing environments. It is specifically designed for pre-installation vetting and CI workflows rather than runtime monitoring.

Can I check for typosquatting in npm and PyPI packages before installation?▼

Dependency auditing checks for CVEs, typosquatting, lockfile integrity, deprecated or unmaintained packages, and license concerns. It generates structured risk reports to help you vet dependencies across npm and PyPI ecosystems.

When should I run a dependency security audit in my development workflow?▼

You should not use dependency auditing for runtime monitoring. It is specifically built for pre-installation vetting, auditing existing environments, and CI workflows to prevent insecure packages from entering a project.

What specific security risks does a dependency audit catch in npm and PyPI ecosystems?▼

Dependency auditing catches CVEs, typosquatting, deprecated or unmaintained packages, lockfile integrity issues, and license concerns. It generates structured risk reports to help you vet dependencies across npm and PyPI ecosystems.

Related Skills

Explore More Software Engineering Skills→
dhruvinrsonidhruvinrsoni

dependency-analysis

Analyze project dependencies by building graphs and detecting circular references.

Community
Advanced
visgwuvisgwu

bandit-security-scan

Run Bandit security analysis to detect vulnerabilities in Python code.

Community
Advanced
arcasilesgrouparcasilesgroup
54

ai-security

Run unified security scans for SAST, DAST, dependencies, and SBOM generation.

Official
Advanced
daffy0208daffy0208
34

forensic-data-engineer

Detect data anomalies and fraud in audit trails and logs.

Community
Advanced