Where does the popular list come from?

npm-high-impact@1.13.0 and hugovk top-pypi-packages (2026-10-01 snapshot), first 3,000 each, plus curated crates/Go lists — cited in references.

Distance 1 from lodash — is it malware?

Unknown. It's a red flag to verify the package is intentional.

package-lock.json (v1–v3) yes. yarn/pnpm recognized with an INFO to convert for full checks.

Pass the repo root; walks looking for known manifest names, skipping node_modules/vendor.

dependency supply chain red flag checker

Example session with this skill installed

Before I npm install this repo — any typosquats or postinstall scripts I should worry about?

Read your context and instructions
Compiled the dependency supply chain

Answer: 2 CRITICAL, 2 HIGH, 4 MEDIUM on the sample app manifests.

CRITICAL (npm): lodahs@4.17.21 is Damerau-Levenshtein distance 1 from popular package lodash
CRITICAL (pypi): requets==2.31.0 is distance 1 from popular requests
HIGH: package.json defines a postinstall lifecycle script (node ./scripts/fetch-assets.js)
HIGH: left-pad depends via git+https://github.com/evil.example/left-pad.git (bypasses the registry)
MEDIUM: floating versions express=latest, react=^18.2.0; unpinned Flask and beautifulsoup4>=4.12

Popular lists loaded from the bundle

npm=3000,

pypi=3000, cargo=103, go=88 (sources cited in references/popular/README.md).

Deliverables: severity-sorted red flags; optional deps.md + JSON. Never installs packages. Never hits the network.

Next steps: verify typosquat hits are intentional before removing; pin versions; drop git/URL deps or vendor them deliberately; review install scripts. A typosquat hit is a signal, not proof of malware.

(Real run on bundled examples/project/.)

Connects securely to your tools. The creator never sees your data.

About this skill

Red-flag your dependencies before you install them.

Reviews package.json / package-lock.json, requirements.txt, pyproject.toml, Cargo.toml and go.mod for lifecycle/install scripts, typosquat distance ≤1 against a bundled popular-package list (3,000 npm + 3,000 PyPI + curated crates/Go), git/URL/tarball deps, and floating versions. Never installs packages. Never hits the network.

What's included

SKILL.md, scripts/depflags.py, references/popular/* with cited sources, sample project.

How to use

Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

Reviews

No reviews yet

Be one of the first to try it. Every listed skill passes our trust checks below.

Security scanned

Passed our 8-point scan before listing

Fresh listing

Recently published to Agensi

Money-back guarantee

Doesn't do what its page promises? You get your money back.

dependency supply chain red flag checker