Check your npm packages for risky dependencies
For anyone shipping a JavaScript app: find the npm packages that could hurt you before an attacker does. Reads package.json and package-lock.json and flags look-alike package names one typo from a popular one, packages installed straight from git or a URL, versions like "*" or "latest", packages that run scripts on install, a missing or stale lockfile, and known vulnerabilities from npm audit, then walks you through each fix. Never installs or runs a package.
- Activity
- New: be the first to try it
- Installs
- 0 installs
- Likes
- 0 likes
- Clones
- 0 clones
How this works
- It is a skill: written instructions Claude reads when your request matches what the skill is for. You do not call it by name; just ask for the task.
- While it works, it reads and changes files in the places it lists, nowhere else.
- It runs these commands on your computer: node scripts/dep-risk.mjs, npm audit, npm view, npm explain, npm ls.
- It talks to registry.npmjs.org over the internet.
- Nothing runs until you choose to use it, and you can remove it any time.
What it can access
What this kit declares, in the same words the CLI shows before you install. On Claude Code the CLI turns these into permission rules, so the agent stops anything undeclared.
Command
Runs the command: node scripts/dep-risk.mjs (with any arguments, without asking)
Command
Runs the command: npm audit (with any arguments, without asking)