NPM Supply Chain Scan

Use the bundled scanner to walk a starting directory recursively and inspect JavaScript/TypeScript projects that use npm, pnpm, or yarn.

The script reports three evidence types separately:

• declared: the package is referenced in package.json
• locked: the affected version is present in a lockfile
• installed: the affected version exists in node_modules/<package>/package.json

Treat locked or installed as stronger evidence than declared.

When to Use

Use this skill when you have incident details such as:

• package name
• affected exact versions
• affected semver range