Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →majiayu000/npm-supply-chain-check
Detect known malicious npm package versions and install-time supply-chain indicators in repositories, lockfiles, and node_modules.
Passed 12 of 17 test cases with the skill, and 10 of 17 without it.
and 1 more in the full report
3 fixed12 passed either way6 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
We suspect malicious obfuscated JavaScript network payloads were bundled inside source files in `src/` and `dist/`. What flag should be passed to the supply chain script to search source and built JS files for campaign strings without printing full file contents?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies adding the --deep flag to the scanner invocation. | Missed | Passed |
| Confirms that deep mode reports paths and indicators without printing surrounding file contents. | Missed | Passed |
The instructions your model reads when the skill loads.
Run an evidence-bounded, read-only scan. Distinguish a dependency reference from proof that malicious code executed, and never read or print secret values.
Resolve the exact repository or directory first. Default to the current repository only. Do not silently expand a repo scan to the user's home directory, all worktrees, global package caches, or CI systems.
Read references/shai-hulud-2026-iocs.json when investigating that incident.
It is a dated minimum baseline, not a complete list of every affected community
package. For an active incident, also check current primary sources such as the
npm registry and maintainer/security advisories before declaring a version safe.
Do not modify the bundled baseline during an ordinary scan.
From this skill directory:
python3 scripts/scan_npm_supply_chain.py <target> --format text
Use JSON when another tool will consume the result:
python3 scripts/scan_npm_supply_chain.py <target> --format json
Add --deep only when source and built JavaScript files should also be searched
for network and campaign strings. Deep mode still reports paths and indicators,
not surrounding file contents.
Exit codes are machine-checkable:
test cases passed, vs 10 / 17 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.