# Dep Audit

> Audit npm/pip dependency packages for security issues. Detects known vulnerabilities (CVE), typosquatting, malicious packages, suspicious install scripts, and supply chain attack patterns. Use when auditing dependencies, after npm install, or reviewing downloaded code.

- Skill: `koach08/dep-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add koach08/dep-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/koach08/dep-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: koach08 (https://skillmd.com/u/koach08)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/koach08/dep-audit

---


# Dep Audit — Dependency Package Security Audit

Audit dependencies for npm, pip, and other package managers.

---

## When to use

- After installing new packages
- Before running `npm install` / `pip install`
- Periodic security checks on a project
- After downloading external code or templates
- When unknown packages appear in your dependency tree

---

## Audit Process

### Phase 1: Known Vulnerability Scan

```bash
# npm
npm audit
npm audit --json  # machine-readable format

# pip (Python)
pip-audit  # install: pip install pip-audit
```

Parse results and classify by Critical / High / Medium / Low.

### Phase 2: Supply Chain Attack Pattern Detection

#### 2a. Typosquatting Detection

Malicious packages with names resembling popular packages:

```
Detection patterns:
- One character off: loadsh (lodash), exprss (express)
- Hyphen/underscore swap: react_dom (react-dom)
- Scope impersonation: @react/core (official is react)
- Similar names: colors.js vs color, event-stream vs events-stream
```

Check every package name in package.json / requirements.txt:
1. Verify it is the official package on npm registry / PyPI
2. Flag packages with extremely low weekly download counts
3. Flag packages where name and description do not match

#### 2b. Suspicious Install Scripts

```bash
# Check scripts section of package.json
grep -E "preinstall|postinstall|preuninstall" package.json
```

Flag the following:
- `preinstall` / `postinstall` with network access (curl, wget, fetch)
- Exfiltration of environment variables
- base64-encoded code
- Use of eval()
- Obfuscated code

#### 2c. Dependency Anomalies

- Packages that recently changed ownership
- Long-dormant packages with sudden updates (hijack indicator)
- Abnormally deep dependency trees
- No version pinning (use of `^` or `*`)

### Phase 3: Downloaded Code Scan

Inspect externally downloaded code and templates:

```bash
# Search for dangerous patterns
grep -rn "eval(" --include="*.js" --include="*.ts" .
grep -rn "Function(" --include="*.js" --include="*.ts" .
grep -rn "child_process" --include="*.js" --include="*.ts" .
grep -rn "exec(" --include="*.js" --include="*.ts" --include="*.py" .
grep -rn "subprocess" --include="*.py" .
grep -rn "base64" --include="*.js" --include="*.ts" --include="*.py" .
grep -rn "fetch\|axios\|request\|urllib" --include="*.js" --include="*.ts" --include="*.py" .
```

Flag the following:
- Data exfiltration to external URLs
- Broad filesystem reads (`fs.readdir`, `os.walk`)
- Collection and exfiltration of environment variables
- Reading SSH keys or credentials
- Obfuscated code (meaningless variable names, base64 encoding)
- Hidden file creation (files starting with `.`)
- Adding cron jobs
- Reverse shell patterns

### Phase 4: Lockfile Integrity Check

```bash
# package-lock.json integrity
npm ci --dry-run

# Check lockfile diff (if changed)
git diff package-lock.json | head -100
```

Flag the following:
- Running `npm install` without a lockfile (no reproducibility)
- Mismatch between lockfile and package.json
- Resolved URLs pointing to non-official registries
- Changed integrity hashes

---

## Package Trust Check

Verify before installing new packages:

| Check | Safe indicator | Red flag |
|-------|---------------|----------|
| Weekly downloads | 10,000+ | Under 100 |
| GitHub Stars | 100+ | 0-10 |
| Last updated | Within 6 months | Abandoned 2+ years |
| Maintainer count | 2+ | 1 with sudden transfer |
| Open issues | Being addressed | All ignored |
| License | MIT/Apache/ISC | None or unknown |
| README | Comprehensive | Empty or machine-translated |
| postinstall | None | Present (inspect closely) |

```bash
# Check package info on npm
npm info {package_name}
npm info {package_name} maintainers
npm info {package_name} time  # publish dates
```

---

## Command Reference

```bash
# Full scan (npm project)
npm audit
npx lockfile-lint --path package-lock.json --type npm --allowed-hosts npm
npx is-website-vulnerable  # check production site dependency vulnerabilities

# Python project
pip-audit
safety check  # install: pip install safety

# Search for suspicious scripts
find . -name "*.js" -o -name "*.ts" | xargs grep -l "eval\|Function\|child_process"
find . -name "postinstall*" -o -name "preinstall*"
```

---

## Output Format

```markdown
## Security Audit Report

### Summary
| Item | Result |
|------|--------|
| Total packages | X |
| Known vulnerabilities | Critical: X, High: X, Medium: X, Low: X |
| Suspicious packages | X |
| Suspicious scripts | X |
| Lockfile integrity | OK / Issues found |

### Critical / High Vulnerabilities
| Package | Version | CVE | Fixed in | Action |
|---------|---------|-----|----------|--------|
| ... | ... | ... | ... | `npm audit fix` / manual update |

### Suspicious Packages (requires review)
1. `{package}` — [reason]

### Suspicious Code Patterns
1. `{file}:{line}` — [finding]

### Recommended Actions
1. ...
2. ...
```

---

## Recommended Schedule

- Run `npm audit` at least once a month per project
- Always check when adding new packages
- Integrate `npm audit --audit-level=high` into CI/CD