supply-chain-security
Typosquatting detection, install script analysis, dependency confusion prevention, and phantom dependency detection for npm/pip.
npx skills add vibeeval/vibecosystem --skill supply-chain-security --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Supply Chain Security Patterns for auditing third-party dependencies before they own your production environment. ## Typosquatting Detection Common substitution patterns attackers use against popular packages: ```python # Levenshtein distance check against known-good package list def levenshtein(a: str, b: str) -> int: if len(a) < len(b): return levenshtein(b, a) if not b: return len(a) prev = list(range(len(b) + 1)) for i, ca in enumerate(a): curr = [i + 1] for j, cb in enumerate(b): curr.append(min(prev[j + 1] + 1, curr[j] + 1, prev[j] + (ca != cb))) prev = curr return prev[-1] POPULAR_PACKAGES = ['express', 'lodash', 'react', 'axios', 'moment', 'chalk'] def is_typosquat(pkg: str, threshold: int = 2) -> list[str]: return [p for p in POPULAR_PACKAGES if 0 < levenshtein(pkg, p) <= threshold] # Examples of known typosquats typosquats = { 'lodahs': 'lodash', # character swap 'expres': 'express', # missing char 'reakt': 'react', # phonetic substitution 'axois': 'axios', # transposition 'momnet': 'moment', # transposition } ``` Common substitution patterns to check manually: - Character transposition: `lodash` → `lodahs` - Missing character: `express` → `expres` - Extra character: `c
- Typosquatting Detection
- Install Script Audit
- Dependency Confusion Risk Assessment
- Phantom Dependency Detection
- Lock File Integrity Verification
- npm audit / pip-audit Integration
- SBOM Generation
- Known Malicious Package Indicators
- Dependency Pinning Strategy
- Dependency Risk Scoring
- Risk Assessment Template
- Automated Risk Check
List all packages with install scripts (npm)
npm query ":root > *" | \
node -e "const d=require('/dev/stdin');
const pkg = require(\`./node_modules/\${k}/package.json\`);
npm pack lodash --dry-run
Check a specific package's install scripts before installing
npm show <package> scripts
Check if your internal package names exist on the public registry
If they do AND the public version is newer, npm may pull the public one
for pkg in "${INTERNAL_PACKAGES[@]}"; doWhat does the supply-chain-security skill do?
Typosquatting detection, install script analysis, dependency confusion prevention, and phantom dependency detection for npm/pip.
How do I install it?
Run `npx skills add vibeeval/vibecosystem --skill supply-chain-security --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From vibeeval/vibecosystem, a repository with 521 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.