dep-audit

name	dep-audit
description	Audit npm/pip dependency packages for security issues. Detects known vulnerabilities (CVE), typosquatting, malicious packages, suspicious install scripts, and supply chain attack patterns. Use when auditing dependencies, after npm install, or reviewing downloaded code.
allowed-tools	["Read","Write","Edit","Bash","Grep","Glob","WebSearch","WebFetch","Agent"]

Dep Audit — Dependency Package Security Audit

Audit dependencies for npm, pip, and other package managers.

---

When to use

• After installing new packages
• Before running npm install / pip install
• Periodic security checks on a project
• After downloading external code or templates
• When unknown packages appear in your dependency tree

---

Audit Process

Phase 1: Known Vulnerability Scan

# npm
npm audit
npm audit --json  # machine-readable format

# pip (Python)
pip-audit  # install: pip install pip-audit

Parse results and classify by Critical / High / Medium / Low.

Phase 2: Supply Chain Attack Pattern Detection

2a. Typosquatting Detection

Malicious packages with names resembling popular packages:

Detection patterns:
- One character off: loadsh (lodash), exprss (express)
- Hyphen/underscore swap: react_dom (react-dom)
- Scope impersonation: @react/core (official is react)
- Similar names: colors.js vs color, event-stream vs events-stream

Check every package name in package.json / requirements.txt:

1. Verify it is the official package on npm registry / PyPI
2. Flag packages with extremely low weekly download counts
3. Flag packages where name and description do not match

2b. Suspicious Install Scripts

# Check scripts section of package.json
grep -E "preinstall|postinstall|preuninstall" package.json

Flag the following:

• preinstall / postinstall with network access (curl, wget, fetch)
• Exfiltration of environment variables
• base64-encoded code
• Use of eval()
• Obfuscated code

2c. Dependency Anomalies

• Packages that recently changed ownership
• Long-dormant packages with sudden updates (hijack indicator)
• Abnormally deep dependency trees
• No version pinning (use of ^ or *)

Phase 3: Downloaded Code Scan

Inspect externally downloaded code and templates:

# Search for dangerous patterns
grep -rn "eval(" --include="*.js" --include="*.ts" .
grep -rn "Function(" --include="*.js" --include="*.ts" .
grep -rn "child_process" --include="*.js" --include="*.ts" .
grep -rn "exec(" --include="*.js" --include="*.ts" --include="*.py" .
grep -rn "subprocess" --include="*.py" .
grep -rn "base64" --include="*.js" --include="*.ts" --include="*.py" .
grep -rn "fetch\|axios\|request\|urllib" --include="*.js" --include="*.ts" --include="*.py" .

Flag the following:

• Data exfiltration to external URLs
• Broad filesystem reads (fs.readdir, os.walk)
• Collection and exfiltration of environment variables
• Reading SSH keys or credentials
• Obfuscated code (meaningless variable names, base64 encoding)
• Hidden file creation (files starting with .)
• Adding cron jobs
• Reverse shell patterns

Phase 4: Lockfile Integrity Check

# package-lock.json integrity
npm ci --dry-run

# Check lockfile diff (if changed)
git diff package-lock.json | head -100

Flag the following:

• Running npm install without a lockfile (no reproducibility)
• Mismatch between lockfile and package.json
• Resolved URLs pointing to non-official registries
• Changed integrity hashes

---

Package Trust Check

Verify before installing new packages:

Check	Safe indicator	Red flag
Weekly downloads	10,000+	Under 100
GitHub Stars	100+	0-10
Last updated	Within 6 months	Abandoned 2+ years
Maintainer count	2+	1 with sudden transfer
Open issues	Being addressed	All ignored
License	MIT/Apache/ISC	None or unknown
README	Comprehensive	Empty or machine-translated
postinstall	None	Present (inspect closely)

# Check package info on npm
npm info {package_name}
npm info {package_name} maintainers
npm info {package_name} time  # publish dates

---

Command Reference

# Full scan (npm project)
npm audit
npx lockfile-lint --path package-lock.json --type npm --allowed-hosts npm
npx is-website-vulnerable  # check production site dependency vulnerabilities

# Python project
pip-audit
safety check  # install: pip install safety

# Search for suspicious scripts
find . -name "*.js" -o -name "*.ts" | xargs grep -l "eval\|Function\|child_process"
find . -name "postinstall*" -o -name "preinstall*"

---

Output Format

## Security Audit Report

### Summary
| Item | Result |
|------|--------|
| Total packages | X |
| Known vulnerabilities | Critical: X, High: X, Medium: X, Low: X |
| Suspicious packages | X |
| Suspicious scripts | X |
| Lockfile integrity | OK / Issues found |

### Critical / High Vulnerabilities
| Package | Version | CVE | Fixed in | Action |
|---------|---------|-----|----------|--------|
| ... | ... | ... | ... | `npm audit fix` / manual update |

### Suspicious Packages (requires review)
1. `{package}` — [reason]

### Suspicious Code Patterns
1. `{file}:{line}` — [finding]

### Recommended Actions
1. ...
2. ...

---

Recommended Schedule

• Run npm audit at least once a month per project
• Always check when adding new packages
• Integrate npm audit --audit-level=high into CI/CD