Skill

package-trust-check

Investigate whether one specific npm package is trustworthy — maintainer/ownership takeover signals, publish-provenance mismatches, and risky install scripts. Use when the user asks if a single named package is safe, compromised, hijacked, suspicious, or "can I trust this" — not for auditing a full package.json/lockfile (see dependency-audit) and not for a plain factual question like "what does X do.

Bundled with NPMScan. Its trust score, security findings and other files are on the plugin page.

npx [email protected] add salemalem/npmscan-mcp-plugin