Supply Chain Security Check

1. Audit Existing Dependencies

npm audit          # Node.js
pip audit          # Python (pip-audit)

2. Check New Package Before Installing

• Verify package name (typosquatting: lodash vs 1odash)
• Check npm/PyPI page: downloads, maintainers, last update
• Check GitHub: stars, issues, last commit
• Verify no postinstall scripts doing suspicious things

3. Lockfile Integrity

• package-lock.json / yarn.lock exists and committed
• No unexpected changes in lockfile
• Integrity hashes present