# Supply Chain

> Checks npm/pip dependencies for known vulnerabilities, typosquatting, and malicious packages. Use before adding new dependencies or during security audits. Don't use for runtime monitoring.

- Skill: `neuron-one/supply-chain` (Agent Skill)
- Install (CLI): `npx skillmds@latest add neuron-one/supply-chain`
- Raw SKILL.md: https://api.skillmd.com/api/skills/neuron-one/supply-chain/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: neuron-one (https://skillmd.com/u/neuron-one)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/neuron-one/supply-chain

---


# Supply Chain Security Check

## 1. Audit Existing Dependencies
```bash
npm audit          # Node.js
pip audit          # Python (pip-audit)
```

## 2. Check New Package Before Installing
- Verify package name (typosquatting: lodash vs 1odash)
- Check npm/PyPI page: downloads, maintainers, last update
- Check GitHub: stars, issues, last commit
- Verify no postinstall scripts doing suspicious things

## 3. Lockfile Integrity
- package-lock.json / yarn.lock exists and committed
- No unexpected changes in lockfile
- Integrity hashes present

## 4. Dependency Health
- No deprecated packages
- No packages with known CVEs
- No unmaintained packages (>1 year no updates)
- Minimal dependency tree (avoid mega-dependencies)

## Output
```
DEPENDENCIES SCANNED: N
VULNERABILITIES: N (critical/high/medium/low)

[For each issue]
PACKAGE: name@version
SEVERITY: critical/high/medium/low
CVE: if applicable
ISSUE: Description
FIX: upgrade to version X / replace with Y
```