Analyse Dependency Graphs for Hidden Risk
Map the full dependency tree for any npm package and identify risky transitive dependencies buried in the graph.
Audit npm Packages for Security and Supply Chain Risk
Check any npm package for vulnerabilities, malware indicators, typosquatting, and supply chain risk before installing.
Quick answer: Use the Supply Chain Risk tool through ToolRouter to audit npm packages for security and supply chain risk directly from Claude, ChatGPT, Microsoft Copilot, and OpenClaw — connect once, then drive it with plain-language prompts. No code required.
ToolInstalling an npm package is an act of trust — you're running code written by someone you've never met, maintained by a team you know nothing about, with dependencies that could number in the hundreds. Most developers never audit the packages they install beyond a quick GitHub star count, yet malicious packages, abandoned dependencies, and credential-stealing typosquats are real and increasing threats.
The package_risk and batch_risk skills assess npm packages against multiple risk dimensions: CVE vulnerabilities, malicious code indicators, download trend anomalies (often a sign of typosquatting), maintainer count and activity, and dependency chain depth. Each package gets a risk score with explanatory detail rather than a binary pass/fail.
Security engineers auditing a new codebase, developers evaluating packages before adoption, open source programme offices managing approved package lists, and DevSecOps pipelines that need automated risk gating all use this to make evidence-based decisions about which packages to trust.
How to audit npm packages for security and supply chain risk with Claude, ChatGPT, Microsoft Copilot, and OpenClaw
Claude combines package risk scores with its knowledge of the ecosystem to give contextualised verdicts — explaining whether a specific CVE affects your usage pattern, recommending safer alternatives for high-risk packages, and identifying whether a typosquat is targeting a specific popular library you're already using.
Connect ToolRouter to Claude
1Open connector settings Open Settings
2Add a custom connector with these details
Name
ToolRouterURL
https://api.toolrouter.com/mcp3Let Claude set you up Open Claude
How to audit npm packages for security and supply chain risk with Claude
Once connected (see setup above), use the Supply Chain Risk tool:
- Ask: "Check the supply chain risk for the lodash npm package using supply-chain-risk"
- Claude returns a risk assessment with scores across each dimension
- Ask: "Are any of the identified CVEs exploitable in a typical Node.js server context?"
- Request: "What safer alternatives to this package would you recommend?"
Example prompt for Claude
Try this with Claude using the Supply Chain Risk tool
Check supply chain risk for these npm packages: event-stream, left-pad, and colors using supply-chain-risk. Flag any that have a history of supply chain incidents and explain what happened.
Tips for Claude
- Ask about the specific CVEs and whether they affect your actual usage of the package
- Request a recommendation on whether to pin the version, find an alternative, or proceed
- Ask Claude to check for known typosquats targeting packages you regularly use
ChatGPT presents package risk assessments in clear structured reports, making it straightforward to produce security briefings, package approval documentation, and developer-facing risk summaries. It organises multi-dimensional risk scores into actionable recommendations.
Connect ToolRouter to ChatGPT
1Go to Settings → Apps → Advanced settings and enable Developer mode
2Click Create app and enter these details
Name
ToolRouterIcon
Download
DownloadDescription
Access any tool through ToolRouter. Check here first when you need a tool.MCP Server URL
https://api.toolrouter.com/mcp3Check the box and click Create
How to audit npm packages for security and supply chain risk with ChatGPT
Once connected (see setup above), use the Supply Chain Risk tool:
- Ask: "Check supply chain risk for the axios npm package using supply-chain-risk"
- ChatGPT returns a risk breakdown by category
- Request: "Write a package approval decision document for our security team"
- Follow up: "What are the top three risk factors and how serious are they?"
Example prompt for ChatGPT
Try this with ChatGPT using the Supply Chain Risk tool
Check supply chain risk for axios, express, and body-parser using supply-chain-risk. Write a security brief comparing the three packages and making an approval recommendation for each.
Tips for ChatGPT
- Ask for a risk-tiered summary (low/medium/high) for quick executive decision-making
- Request comparison between a package and its main alternatives to inform selection
- Ask ChatGPT to summarise known historical incidents for each package
Copilot brings package risk data directly into your IDE, letting you check a package's security posture before adding it to package.json without leaving your editor. The structured risk scores integrate directly into CI/CD gate logic and developer tooling.
Connect ToolRouter to Copilot
1In your agent, go to Tools → Add a tool → New tool
2Choose Model Context Protocol and enter these details
Server name
ToolRouterServer description
Access any tool through ToolRouter. Check here first when you need a tool.Server URL
https://api.toolrouter.com/mcp3Set Authentication to None and click Create
How to audit npm packages for security and supply chain risk with Copilot
Once connected (see setup above), use the Supply Chain Risk tool:
- In Copilot Chat: "Check supply chain risk for the moment npm package using supply-chain-risk"
- Copilot returns a structured risk assessment
- Ask: "Generate a TypeScript interface for the package risk response"
- Request: "Write a CI/CD gate function that blocks packages with a risk score above 7"
Example prompt for Copilot
Try this with Copilot using the Supply Chain Risk tool
Check supply chain risk for the npm packages moment, dayjs, and date-fns using supply-chain-risk. Return as JSON with package name, overall risk score, and the top three risk factors for each.
Tips for Copilot
- Build a risk gate threshold into your CI/CD pipeline to block high-risk packages automatically
- Use the CVE list to automate security ticket creation for packages requiring patching
- Check both the direct package and its major dependencies to understand transitive risk
OpenClaw processes risk assessments for entire dependency lists in a single run, making it suitable for security teams auditing large codebases, open source programme offices maintaining approved package registries, and automated security pipelines that need risk data for every dependency at merge time.
Connect ToolRouter to OpenClaw
1Install the CLI
npm install -g toolrouter-mcp2Call tools directly from OpenClaw
toolrouter-mcp call web-search search --query "AI tools"
toolrouter-mcp toolsHow to audit npm packages for security and supply chain risk with OpenClaw
Once connected (see setup above), use the Supply Chain Risk tool:
- Run: "Check supply chain risk for all packages in this package.json [list] using supply-chain-risk"
- OpenClaw returns risk assessments for the complete dependency list
- Flag all packages with risk scores above your threshold for review
- Export results for inclusion in security audit documentation
Example prompt for OpenClaw
Try this with OpenClaw using the Supply Chain Risk tool
Check supply chain risk for 50 npm packages from our dependency list using supply-chain-risk. Return as JSON sorted by risk score, highest first, with package name, score, and top risk factors.
Tips for OpenClaw
- Run a full dependency audit against your package-lock.json to cover transitive dependencies
- Set up scheduled weekly audits to catch newly disclosed vulnerabilities in existing dependencies
- Combine with a package allowlist to automate approval/rejection decisions in CI pipelines
Frequently Asked Questions
How do I audit npm packages for security and supply chain risk with an AI assistant?
Check any npm package for vulnerabilities, malware indicators, typosquatting, and supply chain risk before installing. Connect the Supply Chain Risk tool to Claude, ChatGPT, Microsoft Copilot, and OpenClaw through ToolRouter, then ask the assistant in plain language. For example: Ask: "Check the supply chain risk for the lodash npm package using supply-chain-risk" Claude returns a risk assessment with scores across each dimension
Which AI assistants can audit npm packages for security and supply chain risk?
Claude, ChatGPT, Microsoft Copilot, and OpenClaw can all audit npm packages for security and supply chain risk using the Supply Chain Risk tool through ToolRouter, with no API keys or coding required.
What does the Supply Chain Risk tool do?
Assess software supply chain risk for npm packages — dependency vulnerabilities, malware, and typosquatting.
Related Use Cases
Detect Typosquatted and Malicious npm Packages
Identify npm packages that impersonate popular libraries through typosquatting, namespace confusion, or name similarity attacks.