Audit npm Packages for Security and Supply Chain Risk
Check any npm package for vulnerabilities, malware indicators, typosquatting, and supply chain risk before installing.
Analyse Dependency Graphs for Hidden Risk
Map the full dependency tree for any npm package and identify risky transitive dependencies buried in the graph.
Quick answer: Use the Supply Chain Risk tool through ToolRouter to analyse dependency graphs for hidden risk directly from Claude, ChatGPT, Microsoft Copilot, and OpenClaw — connect once, then drive it with plain-language prompts. No code required.
ToolWhen you install a package with 5 direct dependencies, you're actually installing the entire subtree — which might be 200 packages deep. One compromised package anywhere in that tree can exfiltrate credentials, inject malware, or cause a supply chain attack. Almost nobody audits transitive dependencies because the graph is too large to inspect manually.
The dependency_graph skill maps the full dependency tree for a given package, returning a structured representation of every direct and transitive dependency. Combined with package_risk, you can identify which nodes in the graph carry the most risk — without reading every one of hundreds of package.json files manually.
Security architects scoping the blast radius of a supply chain incident, developers evaluating whether a new package brings unwanted dependencies, and security tools that need full dependency inventories for SBOM (Software Bill of Materials) generation all use this to understand what they're actually running.
How to analyse dependency graphs for hidden risk with Claude, ChatGPT, Microsoft Copilot, and OpenClaw
Connect ToolRouter
1Open connector settings Open Settings
2Add a custom connector with these details
Name
ToolRouterURL
https://api.toolrouter.com/mcp3Let Claude set you up Open Claude
Claude navigates complex dependency graphs to surface the risks that matter — identifying which transitive packages are most widely used (and therefore highest-impact if compromised), flagging dependencies with concerning maintenance signals, and explaining why a specific deep dependency poses a risk to the whole tree.
How to analyse dependency graphs for hidden risk
Once connected (see setup above), use the Supply Chain Risk tool — the same steps work with Claude, ChatGPT, Microsoft Copilot, OpenClaw, and any MCP client:
- Ask: "Get the dependency graph for the express npm package using supply-chain-risk"
- Claude returns a structured dependency tree
- Ask: "Check risk scores for the five most common dependencies in this graph using supply-chain-risk"
- Request: "Which transitive dependencies represent the highest risk in this tree?"
Example prompt
Try this with the Supply Chain Risk tool
Get the dependency graph for webpack using supply-chain-risk, then check risk scores for the packages with the most dependents in the graph. Which transitive packages pose the greatest supply chain risk?
Tips
- Focus risk checks on the most widely-used transitive packages first — they affect the most code
- Ask Claude to identify any packages in the graph with fewer than two maintainers
- Look for packages with recent ownership changes — a common vector for supply chain attacks
Frequently Asked Questions
How do I analyse dependency graphs for hidden risk with an AI assistant?
Map the full dependency tree for any npm package and identify risky transitive dependencies buried in the graph. Connect the Supply Chain Risk tool to Claude, ChatGPT, Microsoft Copilot, and OpenClaw through ToolRouter, then ask the assistant in plain language. For example: Ask: "Get the dependency graph for the express npm package using supply-chain-risk" Claude returns a structured dependency tree
Which AI assistants can analyse dependency graphs for hidden risk?
Claude, ChatGPT, Microsoft Copilot, and OpenClaw can all analyse dependency graphs for hidden risk using the Supply Chain Risk tool through ToolRouter, with no API keys or coding required.
What does the Supply Chain Risk tool do?
Assess software supply chain risk for npm packages — dependency vulnerabilities, malware, and typosquatting.
Related Use Cases
Detect Typosquatted and Malicious npm Packages
Identify npm packages that impersonate popular libraries through typosquatting, namespace confusion, or name similarity attacks.