Dependency Supply Chain Scanner

How this scan works

• Lockfile integrity: a package.json with no committed lockfile means every install resolves ranges afresh, so CI, production and the machine the code was reviewed on can each get a different dependency tree
• Install-time lifecycle scripts (preinstall / install / postinstall / prepare) — code that runs before anything is imported or reviewed, and the delivery mechanism for essentially every npm supply-chain attack
• Dependency confusion: every scoped @org/package name in your manifests is checked against the public npm registry, and flagged if unclaimed — anyone can publish that name, and default resolution prefers the higher public version
• Version specifiers that resolve to whatever exists at install time: *, latest, git+https URLs and plaintext-HTTP tarballs
• Whether .gitignore actually covers .env, key files and node_modules — the leak that hasn’t happened yet