Skill

incident-response

Turn a flagged npm supply-chain finding — or just a vague, non-technical description of one ("this package looks sketchy," "someone said we got hacked," "npm install did something weird") — into concrete remediation steps. Use whenever the user wants to know what to actually do about a suspicious/compromised/flagged package, however precisely or vaguely they describe it — not for the initial trust/vulnerability investigation itself (see package-trust-check/dependency-audit for that).

Bundled with NPMScan. Its trust score, security findings and other files are on the plugin page.

npx [email protected] add salemalem/npmscan-mcp-plugin