Dep Audit

Dep Audit — Dependency Package Security Audit

Audit dependencies for npm, pip, and other package managers.

When to use

• After installing new packages
• Before running npm install / pip install
• Periodic security checks on a project
• After downloading external code or templates
• When unknown packages appear in your dependency tree

Audit Process

Phase 1: Known Vulnerability Scan

# npm
npm audit
npm audit --json  # machine-readable format

# pip (Python)
pip-audit  # install: pip install pip-audit

Parse results and classify by Critical / High / Medium / Low.

Phase 2: Supply Chain Attack Pattern Detection

2a. Typosquatting Detection

Malicious packages with names resembling popular packages:

Detection patterns:
- One character off: loadsh (lodash), exprss (express)
- Hyphen/underscore swap: react_dom (react-dom)
- Scope impersonation: @react/core (official is react)
- Similar names: colors.js vs color, event-stream vs events-stream

Check every package name in package.json / requirements.txt:

1. Verify it is the official package on npm registry / PyPI
2. Flag packages with extremely low weekly download counts
3. Flag packages where name and description do not match

2b. Suspicious Install Scripts

# Check scripts section of package.json
grep -E "preinstall|postinstall|preuninstall" package.json

Flag the following:

• preinstall / postinstall with network access (curl, wget, fetch)
• Exfiltration of environment variables
• base64-encoded code
• Use of eval()
• Obfuscated code

2c. Dependency Anomalies

• Packages that recently changed ownership
• Long-dormant packages with sudden updates (hijack indicator)
• Abnormally deep dependency trees
• No version pinning (use of ^ or *)

Phase 3: Downloaded Code Scan

Inspect externally downloaded code and templates:

# Search for dangerous patterns
grep -rn "eval(" --include="*.js" --include="*.ts" .
grep -rn "Function(" --include="*.js" --include="*.ts" .
grep -rn "child_process" --include="*.js" --include="*.ts" .
grep -rn "exec(" --include="*.js" --include="*.ts" --include="*.py" .
grep -rn "subprocess" --include="*.py" .
grep -rn "base64" --include="*.js" --include="*.ts" --include="*.py" .
grep -rn "fetch\|axios\|request\|urllib" --include="*.js" --include="*.ts" --include="*.py" .

Flag the following:

• Data exfiltration to external URLs
• Broad filesystem reads (fs.readdir, os.walk)
• Collection and exfiltration of environment variables
• Reading SSH keys or credentials
• Obfuscated code (meaningless variable names, base64 encoding)
• Hidden file creation (files starting with .)
• Adding cron jobs
• Reverse shell patterns

Phase 4: Lockfile Integrity Check

# package-lock.json integrity
npm ci --dry-run

# Check lockfile diff (if changed)
git diff package-lock.json | head -100

Flag the following:

• Running npm install without a lockfile (no reproducibility)
• Mismatch between lockfile and package.json
• Resolved URLs pointing to non-official registries
• Changed integrity hashes

Package Trust Check

Verify before installing new packages:

# Check package info on npm
npm info {package_name}
npm info {package_name} maintainers
npm info {package_name} time  # publish dates

Command Reference

# Full scan (npm project)
npm audit
npx lockfile-lint --path package-lock.json --type npm --allowed-hosts npm
npx is-website-vulnerable  # check production site dependency vulnerabilities

# Python project
pip-audit
safety check  # install: pip install safety

# Search for suspicious scripts
find . -name "*.js" -o -name "*.ts" | xargs grep -l "eval\|Function\|child_process"
find . -name "postinstall*" -o -name "preinstall*"

Output Format

## Security Audit Report

### Summary
| Item | Result |
|------|--------|
| Total packages | X |
| Known vulnerabilities | Critical: X, High: X, Medium: X, Low: X |
| Suspicious packages | X |
| Suspicious scripts | X |
| Lockfile integrity | OK / Issues found |

### Critical / High Vulnerabilities
| Package | Version | CVE | Fixed in | Action |
|---------|---------|-----|----------|--------|
| ... | ... | ... | ... | `npm audit fix` / manual update |

### Suspicious Packages (requires review)
1. `{package}` — [reason]

### Suspicious Code Patterns
1. `{file}:{line}` — [finding]

### Recommended Actions
1. ...
2. ...

Recommended Schedule

• Run npm audit at least once a month per project
• Always check when adding new packages
• Integrate npm audit --audit-level=high into CI/CD