codex

NPMScan

Check npm packages for malware, known vulnerabilities, typosquats and maintainer takeovers before installing, via npmscan.com's free, read-only MCP server (23 tools, no API key).

1,566 on GitHubby BlockHacks.iov3.1.3MITupdated todayTools & Integrations

Plugin npmscan in hashgraph-online/awesome-codex-plugins. Commands read from the repo's manifest — today.

What it installs

Skills (5)

  • ci-pr-gate

    Turn a dependency change — a before/after package.json/lockfile snapshot, or one or more named "bump X from A to B" upgrades — into one deterministic PASS/WARN/FAIL verdict formatted for a CI check or PR-comment bot, not a conversational report. Use when the user explicitly wants a mergeable/blockin

  • dependency-audit

    Audit a project's npm dependencies for known vulnerabilities and risky install scripts before installing, upgrading, or shipping. Use when the user pastes or attaches a package.json/lockfile, lists dependencies, or asks to check/audit/scan their packages for security issues — including comparing two

  • incident-response

    Turn a flagged npm supply-chain finding — or just a vague, non-technical description of one ("this package looks sketchy," "someone said we got hacked," "npm install did something weird") — into concrete remediation steps. Use whenever the user wants to know what to actually do about a suspicious/co

  • new-dependency-evaluation

    Help decide what to add as a NEW npm dependency — comparing 2-5 named candidates for the same job, evaluating one named candidate against its real peers, or shortlisting candidates from a described need, before anything is installed. Use for "which should we use for X," "axios vs got vs node-fetch,"

  • package-trust-check

    Investigate whether one specific npm package is trustworthy — maintainer/ownership takeover signals, publish-provenance mismatches, and risky install scripts. Use when the user asks if a single named package is safe, compromised, hijacked, suspicious, or "can I trust this" — not for auditing a full

MCP servers (1)

  • npmscan

    connects to: https://npmscan.com/api/mcp

View source on GitHub npmscan.com

More from hashgraph-online/awesome-codex-plugins

All 451 plugins →

LVTD Skills

codex

Reusable Agent Skills for Codex, Claude Code, and compatible clients, covering Django, Rust, Cookiecutter, SEO, traction, product marketing, and nonfiction publishing workflows.

200 skills

1,566

Research Agent Skills

codex

280+ Agent Skills that turn Codex, Claude Code, Cursor and other agents into a research co-scientist across the academic research lifecycle: literature and PRISMA reviews, hypotheses, experimental design, data analysis in biology, chemistry, medicine, physics and ML, paper writing, citation verification and peer review.

200 skills

1,566

Team Skills Platform

codex

Role-based team delivery framework — Tech Lead-orchestrated 8-role system with 195+ skills, 27 specialist agents, 80+ commands, hooks, and ECC harness for Claude Code, Codex, and OpenCode.

175 skills

1,566

Digital Marketing Pro

codex

Open-source AI marketing plugin for agencies — 154 skills, 25 specialist agents, 12-Part Strategy Flow, AEO/GEO, GSC AI Performance Report, Google Ads API v24, EU AI Act Article 50 / C2PA compliance.

164 skills · hooks

1,566

CometChat

codex

Add real-time chat, voice and video calling to React, Angular, React Native, iOS, Android and Flutter apps, with the CometChat Docs MCP for current docs.

98 skills · 1 MCP server

1,566

varg

codex

How to make any AI video: find the skill, the options to show and the steps (no key needed), with the keyless varg how to MCP and the varg MCP for video, image, voice and music generation.

78 skills · 2 MCP servers

1,566

Similar plugins

ecc

claudecodex

Harness-native ECC operator layer - 71 agents, 314 skills, 98 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses

200 skills · 98 commands · 71 agents · 1 MCP server · hooks

affaan-m/ECC 302,088

security-guidance

claude

Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.

hooks

anthropics/claude-code 155,476

ruflo-federation

claude

Cross-installation agent federation with zero-trust security, PII-gated data flow, and compliance-grade audit trails

3 skills · 1 command · 1 agent

ruvnet/ruflo 81,589

duende-skills

claudecodex

Duende development skills and agents for Claude Code — covering OAuth/OIDC protocols, IdentityServer, token management, ASP.NET Core authentication/authorization, BFF patterns, and secure identity architecture

24 skills · 2 agents

anthropics/claude-plugins-official 47,076

security-scanning

claudecodex

SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening

5 skills · 3 commands · 2 agents

wshobson/agents 42,461

Maintain NPMScan?

This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.

claude & codex plugins451 plugins