Audit npm Packages for Security and Supply Chain Risk

Installing an npm package is an act of trust — you're running code written by someone you've never met, maintained by a team you know nothing about, with dependencies that could number in the hundreds. Most developers never audit the packages they install beyond a quick GitHub star count, yet malicious packages, abandoned dependencies, and credential-stealing typosquats are real and increasing threats.

The package_risk and batch_risk skills assess npm packages against multiple risk dimensions: CVE vulnerabilities, malicious code indicators, download trend anomalies (often a sign of typosquatting), maintainer count and activity, and dependency chain depth. Each package gets a risk score with explanatory detail rather than a binary pass/fail.

Security engineers auditing a new codebase, developers evaluating packages before adoption, open source programme offices managing approved package lists, and DevSecOps pipelines that need automated risk gating all use this to make evidence-based decisions about which packages to trust.