Dependency Audit Stinger

dependency-audit Stinger

Procedural arsenal for dependency-audit-worker-bee, the npm supply-chain hygiene specialist for the @deeplake/hivemind package. This stinger encodes the 2026-current toolchain decision matrix, npm audit triage workflow, SBOM generation pipeline, package-lock.json discipline checklist, the tree-sitter native-dependency risk, and npm provenance verification - all scoped to this one npm package.

First action when this stinger is loaded: Read guides/00-scanner-decision-matrix.md to orient to the toolchain landscape before doing anything else. Every other guide assumes you have read that decision matrix.

Repo ground truth (read before acting)

@deeplake/hivemind is an ESM, TypeScript ^6, Node >=22 npm package. The supply-chain facts that matter:

• Lockfile: package-lock.json (npm - NOT pnpm or yarn). CI installs with npm ci.
• Runtime deps: deeplake, @modelcontextprotocol/sdk, @anthropic-ai/sdk, zod, js-yaml, just-bash, yargs-parser.
• optionalDependencies + native ABI risk: @huggingface/transformers plus the full tree-sitter grammar set (c/cpp/go/java/javascript/python/ruby/rust/typescript). Three grammars are version-pinned in overrides (tree-sitter-c, tree-sitter-python, tree-sitter-rust). The postinstall hook runs scripts/ensure-tree-sitter.mjs, which heals native ABI / arm64 build failures. This native-dependency surface is the single biggest supply-chain risk on this package - a compromised or broken grammar build runs install-time code on every consumer's machine.
• Publish guards: prepack builds; the files allowlist controls what ships; scripts/pack-check.mjs (npm run pack:check) blocks publishing secrets; scripts/audit-openclaw-bundle.mjs (npm run audit:openclaw) replicates ClawHub's static scan of the OpenClaw bundle.
• CI: .github/workflows/ - ci.yaml runs a cross-node install; codeql.yaml scans javascript-typescript. CodeRabbit profile is chill.

When this stinger applies

Load this stinger when dependency-audit-worker-bee is invoked. Typical triggers:

• "Set up Renovate for Hivemind / Renovate vs Dependabot for this repo"
• "Our dependency-update PRs are noisy"
• "npm audit returns findings - help me triage"
• "npm audit shows clean but I don't trust it"
• "The tree-sitter postinstall is failing / is it safe?"
• "We need an SBOM for the published package"
• "Generate an SBOM and attest it in CI"
• "Set up socket.dev to catch malicious packages"
• "Should we publish with --provenance?"
• "Is our npm publish safe? / what guards the published bundle?"
• "package-lock.json keeps changing unexpectedly"

Do NOT load it for:

• Application-code CVEs requiring code changes -> security-worker-bee
• Container image scanning -> ci-release-worker-bee
• License compatibility legal opinions -> legal counsel
• CI/CD pipeline architecture beyond the dependency scanning step -> ci-release-worker-bee

Critical directives

These are the non-negotiables. The full rationale lives in each guide.

• Never recommend ignoring a CVE without requiring an expiry date and a tracking issue link. See guides/01-vulnerability-triage.md.
• Always differentiate direct vs transitive exposure before recommending an upgrade. Most npm audit findings on this package are transitive and unreachable. See guides/01-vulnerability-triage.md.
• Treat the tree-sitter / optionalDependencies surface as the primary install-time risk. Any change there must keep scripts/ensure-tree-sitter.mjs working and must not loosen the overrides pins without justification. See guides/01-vulnerability-triage.md and guides/03-lockfile-discipline.md.
• Prefer Renovate over Dependabot for this repo because of grouping and minimumReleaseAge. See guides/00-scanner-decision-matrix.md.
• Always validate package-lock.json integrity after any dependency change. npm ci is the enforcement control. See guides/03-lockfile-discipline.md.
• Do not gate CI on low/moderate npm audit findings. Gate only on high and critical. See guides/01-vulnerability-triage.md.
• Never weaken the publish guards. The files allowlist, pack-check.mjs, and audit:openclaw are the publish-time defense. See guides/04-provenance-verification.md.
• Defer to security-worker-bee for any CVE that requires patching application code, not just upgrading a package.

Toolchain overview (2026 state)

Key 2026 insight: npm audit is a CVE compliance tool, not a supply-chain security tool. The March 2026 axios maintainer account hijack published a backdoor in 40 minutes with no CVE at time of attack - npm audit showed clean throughout. For this package the equivalent nightmare is a tampered tree-sitter grammar running install-time code via postinstall. socket.dev behavioral analysis and Renovate minimumReleaseAge are the controls that address this class. See research/external/04-npm-provenance-sigstore-2026.md.

Guide map

Read the guide matching your task:

Template map

Folder layout

dependency-audit-stinger/
+- SKILL.md                                   (this file)
+- README.md                                  (one-page human overview)
+- guides/
|  +- 00-scanner-decision-matrix.md           (Renovate vs Dependabot + npm audit + socket.dev for this package)
|  +- 01-vulnerability-triage.md              (npm audit noise vs real, direct vs transitive, tree-sitter native-dep risk)
|  +- 02-sbom-workflow.md                     (Syft + CycloneDX 1.6 + Sigstore for the published tarball)
|  +- 03-lockfile-discipline.md               (npm ci + package-lock.json + minimumReleaseAge + optionalDependencies pins)
|  +- 04-provenance-verification.md           (npm --provenance + audit signatures + files allowlist / pack-check / audit-openclaw / CodeQL)
+- examples/
|  +- happy-path-node-scanner-setup.md        (Renovate + npm audit + socket.dev for @deeplake/hivemind)
|  +- edge-case-critical-cve-triage.md        (triaging a transitive CVE pulled through a Hivemind dependency)
+- templates/
|  +- renovate-base-config.json               (ready-to-use Renovate config for this repo)
|  +- github-actions-sbom-workflow.yml        (SBOM + attestation workflow)
|  +- dependency-triage-report.md             (npm audit triage report template)
+- reports/
|  +- README.md                               (how audit reports accumulate)
+- research/                                  (DO NOT MODIFY -- owned by scripture-historian)
   +- research-plan.md
   +- research-summary.md
   +- index.md
   +- internal/01-command-brief.md
   +- external/ (5 source files)

Pairing

Forged by stinger-forge, retargeted to the @deeplake/hivemind npm package. Part of The Hive, curated by Mario Aldayuz a.k.a @thenotoriousllama.