npmscan

GitHub Action that inspects pull requests touching package.json or a lockfile and flags risky npm dependency changes before they merge. Checks added packages against OSV.dev and GitHub Advisories for known vulnerabilities and malware, detects newly introduced install scripts, and catches lockfile entries that point to unexpected tarballs or hosts, posting PR comments and failing the check on configurable severity thresholds.