dependency-lockfile-audit
Installation
SKILL.md
Dependency Lockfile Audit
Detect malicious, typosquatted, and vulnerable dependencies before they compromise your application. Supply chain attacks are increasingly common -- a single malicious package can exfiltrate all your environment variables on install.
The Rule
ALWAYS commit lockfiles. ALWAYS audit before installing. NEVER ignore security warnings.
Attack Vectors
| Attack | How it works | Example |
|---|---|---|
| Typosquatting | Package name looks like popular one | expresss instead of express |
| Dependency confusion | Private package name claimed on public registry | @company/utils published by attacker on npm |
| Malicious postinstall | Script runs on npm install |
Steals .env, SSH keys, sends to attacker |
| Protestware | Maintainer adds destructive code in update | Wipes files, shows political messages |
| Abandoned takeover | Attacker gains control of unmaintained package | Injects crypto miner |