Skills CLI
Installs, updates and removes agent skills for Claude Code, Codex, Cursor and more
by Vercel Labs
NPMScan
by BlockHacks.ioPluginWrite code
Checks whether an npm package has known security problems before you install it
The problem it solves
Your AI assistant wants to add a package you have never heard of, and you have no quick way to tell whether it is risky.
For DevelopersTeams reviewing dependency changes
- Before
- You search the package name, read its npm page and advisories, and guess whether its maintainers are still the real ones.
- After
- You ask in chat and get a report on known vulnerabilities, malware findings, maintainers and install scripts, with links to the full write-up.
- Stars
- ★ 501
- License
- MIT
- Cost
- Free
- For
- Claude Code
- Contents
- Instructions only
Overview
NPMScan is a plugin that connects Claude Code to npmscan.com's free, read-only package lookup service. Name a package, paste a package.json or lockfile, or give a GitHub repository link, and it reports known vulnerabilities, malware findings, maintainer changes and risky install scripts, with links to the full write-up. It also compares candidate packages and ranks what to fix first. It suits developers and teams reviewing the packages their projects depend on.
It needs no account or API key, and it reports a package flagged as malware as something to remove, not as an ordinary bug.
Try these first
Start with the first one: it is a small task you can check easily.
- Does [package name] have any known vulnerabilities? Just report; don't change anything.First try · read-only
- Before I install [package name], tell me about its maintainers and install scripts.
- Compare [package A], [package B] and [package C] for [job] and suggest one.
- Audit my dependencies for vulnerabilities: [paste package.json]sends your file
Example prompts written by Agent Flows Hub.
What you get
From the creator's documentation.
| Output | What it is | Reads |
|---|---|---|
| Package lookup | Latest version, maintainers, license, downloads and install scripts for one package | Public npm data |
| Vulnerability check | Known vulnerabilities from OSV.dev, with malware findings marked separately | Public advisory data |
| Package check | Maintainer changes, publish provenance and an install-script scan for one package | Public npm data |
| Dependency audit | One report for a pasted package.json, lockfile or GitHub repository link | Your file, sent to npmscan |
| Package comparison | A side-by-side of 2 to 5 candidate packages with a suggested pick | Public npm data |
| Fix order | Findings ranked by what to fix first, with incident-response steps | What you paste |
Good to know
Before you or your agent add a package, ask whether it has known problems. The plugin looks up public advisory and registry data through npmscan.com and returns one report per package or per dependency list.
Limits
- The hosted service is limited to 30 requests a minute per IP address, and its data comes from public sources such as OSV.dev, GitHub advisories and NIST NVD.
- The install-script scan is a static heuristic, not proof of malice. A clean result does not show that a package is harmless.
Notes by Agent Flows Hub (original project name: npmscan-mcp-plugin), written from the creator's documentation, not from running it ourselves. NPMScan plugin for Claude Code: README · NPMScan MCP setup for other clients
Stuck setting it up?
Tell us what happened. We take a look first; if it needs paid work, you get an estimate before anything starts.
More to write code
Other plugins
- Obsidian Second Brain Lets Claude Code save, find and update notes in your Obsidian vault across sessions
- OpenCode Notifier Plays a sound and shows a desktop alert when OpenCode finishes, fails or needs your OK
- Receipts for Claude Code Makes a printable report of what your Claude Code use shipped, by project, for a manager
- Save to Spotify Turns notes, articles or meeting transcripts into narrated episodes saved to your Spotify
- Telegram for Claude Code Lets you message your running Claude Code session from Telegram and get replies there
- text-to-cad Lets your AI agent design 3D parts from a description and export files ready to print