Dependency Drift Audit 1

Static, offline audit of the user's own project dependencies using scripts/drift.js. It reads package.json and package-lock.json / yarn.lock and emits a JSON report of hygiene findings. It never installs, executes, or downloads packages.

• Run only on the user's own project files.
• This is a hygiene audit, not a vulnerability scanner — no findings here does not mean "no CVEs". Always say so and suggest npm audit or the user's SCA tool for advisories.
• Typosquat findings are a similarity heuristic — always advise the user to verify the package on the registry rather than asserting it is malicious.
• Never modify package.json, lockfiles, or install/uninstall anything unless the user asks.

Requires Node 18+.

Exit codes: 0 clean, 1 findings, 2 usage/read error — usable as a CI gate.