Installs into .claude/skills of the current project.
Are you the author of Supply Chain Review?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/yongquantan-supply-chain-review)
# Supply Chain Review
When the user asks about dependency security, supply chain hardening, or wants to review
the safety of their installed packages, use this skill.
## What to check
1. **Lockfile integrity** — Are `package-lock.json` / `yarn.lock` / `uv.lock` committed and up to date?
2. **Pinned versions** — Are dependencies pinned to exact versions (not ranges)?
3. **Install scripts** — Run `npm pkg get scripts.postinstall` or check `setup.py` for install-time code execution.
4. **Known vulnerabilities** — Run `npm audit` or `pip audit` if available.
5. **Forensic logs** — Check `~/.dep-guard/logs/` for recent audit logs from Dependency Guard.
## Recent attack patterns to watch for
- **Phantom dependencies**: A package adds a dependency that doesn't exist on the registry, then publishes it with malware (e.g., axios + plain-crypto-js).
- **Postinstall RATs**: Malicious code in postinstall hooks that phones home and drops a remote access trojan (e.g., LiteLLM .pth file attack).
- **Typosquatting**: Packages with names similar to popular ones (e.g., `axois` instead of `axios`).
- **Credential harvesting**: Postinstall scripts that read ~/.ssh, ~/.aws, or environment variables and exfiltrate them.
## Hardening recommendations
- Disable install scripts globally: `npm config set ignore-scripts true` (re-enable per package as needed)
- Use `--ignore-scripts` flag for installs of unfamiliar packages
- Pin all dependency versions and commit lockfiles
- Review diffs when lockfiles change in PRs
