npm-security
bodadotsh/npm-security-best-practicesSkill
Prevent JavaScript/TypeScript projects from supply-chain attacks across package managers like npm, pnpm, yarn, bun, and deno. Use whenever planning, installing, updating dependencies or configuring package managers
Why this score
Popularity score: 72/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank
Security
Scanned Oct 21, 2026 at commit 24fb07d40643, with Cisco's open-source skill-scanner.
None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.
A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan
Alternatives
Other makers' add-ons that do the same job, next to this one.
| Name | Score | Stars | Context | Updated |
|---|---|---|---|---|
| This onenpm-security bodadotsh/npm-security-best-practices · Skill | 72 | ★ 859 | ≈57 always | 1mo ago |
| ai-mcp-security Netw0rkNoob/VulnClaw · Skill Both about security | 71 | ★ 3.8k | ≈20 always | 23d ago |
| secure-npm-package evilmartians/agent-skills · Skill Both about npm and package | 58 | ★ 49 | ≈75 always | 21d ago |
| Nekzus-npm-sentinel-mcp Nekzus/npm-sentinel-mcp · MCP server Both about npm and security | 73 | ★ 18 | not measured | 2mo ago |
| npm-release luochang212/skill-zoo · Skill Both about npm and package | 63 | ★ 120 | ≈89 always | 18d ago |
| list-npm-package-content vercel/ai · Skill Both about npm and package | 76 | ★ 27k | ≈54 always | 16d ago |