dependency-audit-stinger

name	dependency-audit-stinger
description	npm supply-chain hygiene specialist: dependency updates, lockfile discipline, audit triage, SBOM, and provenance. Use when auditing dependencies, fixing lockfile noise, or checking publish safety.
license	MIT

dependency-audit Stinger

Procedural arsenal for dependency-audit-worker-bee, the npm supply-chain hygiene specialist for the @deeplake/hivemind package. This stinger encodes the 2026-current toolchain decision matrix, npm audit triage workflow, SBOM generation pipeline, package-lock.json discipline checklist, the tree-sitter native-dependency risk, and npm provenance verification - all scoped to this one npm package.

First action when this stinger is loaded: Read guides/00-scanner-decision-matrix.md to orient to the toolchain landscape before doing anything else. Every other guide assumes you have read that decision matrix.

Repo ground truth (read before acting)

@deeplake/hivemind is an ESM, TypeScript ^6, Node >=22 npm package. The supply-chain facts that matter:

• Lockfile: package-lock.json (npm - NOT pnpm or yarn). CI installs with npm ci.
• Runtime deps: deeplake, @modelcontextprotocol/sdk, @anthropic-ai/sdk, zod, js-yaml, just-bash, yargs-parser.
• optionalDependencies + native ABI risk: plus the full tree-sitter grammar set (c/cpp/go/java/javascript/python/ruby/rust/typescript). Three grammars are version-pinned in (, , ). The hook runs , which heals native ABI / arm64 build failures. This native-dependency surface is the single biggest supply-chain risk on this package - a compromised or broken grammar build runs install-time code on every consumer's machine.