diff --git a/.factory-plugin/marketplace.json b/.factory-plugin/marketplace.json
index 4282159..90f52ca 100644
--- a/.factory-plugin/marketplace.json
+++ b/.factory-plugin/marketplace.json
@@ -53,6 +53,17 @@
       "description": "Pull request lifecycle skills: create PRs with consistent conventions and follow up on them until merge-ready",
       "source": "./plugins/code-review",
       "category": "productivity"
+    },
+    {
+      "name": "npmscan",
+      "description": "Check npm packages for malware, known vulnerabilities, typosquats, maintainer takeovers and risky install scripts before installing, and audit a package.json, lockfile, SBOM or GitHub repo, through NPMScan's hosted, read-only MCP server",
+      "source": {
+        "source": "url",
+        "url": "https://github.com/salemalem/npmscan-mcp-plugin.git",
+        "sha": "e83bfb4235ffd6037c47e6198e1ee7bbc33f5333"
+      },
+      "category": "security",
+      "homepage": "https://npmscan.com/docs/mcp"
     }
   ]
 }
diff --git a/README.md b/README.md
index 62f7f3f..732de33 100644
--- a/README.md
+++ b/README.md
@@ -101,6 +101,18 @@ Skills for continuous learning and improvement.
 
 Autonomous experiment loop for optimization research. Try an idea, measure it, keep what works, discard what doesn't, repeat. Works standalone or as a mission worker.
 
+### npmscan
+
+[NPMScan](https://npmscan.com) plugin, sourced from [salemalem/npmscan-mcp-plugin](https://github.com/salemalem/npmscan-mcp-plugin) at a pinned commit. It connects the hosted, read-only `npmscan` MCP server (`https://npmscan.com/api/mcp`, no sign-in or API key) for npm supply-chain checks: malware, known vulnerabilities (OSV.dev, GitHub Security Advisories, NVD), typosquats, maintainer takeovers, install scripts and publish provenance.
+
+**Skills:**
+
+- `dependency-audit` - Audit a package.json, lockfile or SBOM for vulnerable and risky dependencies
+- `package-trust-check` - Check whether one package is trustworthy: maintainer changes, provenance and install scripts
+- `new-dependency-evaluation` - Compare candidate packages before adding a new dependency
+- `incident-response` - Turn a flagged or suspicious package into concrete remediation steps
+- `ci-pr-gate` - Give a PASS/WARN/FAIL verdict for a dependency change in a PR
+
 ## Plugin Structure
 
 Each plugin follows the Factory plugin format: