Skip to content

Add npmscan plugin (external url source) #60

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
salemalem wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add npmscan plugin (external url source) #60

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions .factory-plugin/marketplace.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,17 @@
"description": "Pull request lifecycle skills: create PRs with consistent conventions and follow up on them until merge-ready",
"source": "./plugins/code-review",
"category": "productivity"
},
{
"name": "npmscan",
"description": "Check npm packages for malware, known vulnerabilities, typosquats, maintainer takeovers and risky install scripts before installing, and audit a package.json, lockfile, SBOM or GitHub repo, through NPMScan's hosted, read-only MCP server",
"source": {
"source": "url",
"url": "https://github.com/salemalem/npmscan-mcp-plugin.git",
"sha": "e83bfb4235ffd6037c47e6198e1ee7bbc33f5333"
},
"category": "security",
"homepage": "https://npmscan.com/docs/mcp"
}
]
}
12 changes: 12 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,18 @@ Skills for continuous learning and improvement.

Autonomous experiment loop for optimization research. Try an idea, measure it, keep what works, discard what doesn't, repeat. Works standalone or as a mission worker.

### npmscan

[NPMScan](https://npmscan.com) plugin, sourced from [salemalem/npmscan-mcp-plugin](https://github.com/salemalem/npmscan-mcp-plugin) at a pinned commit. It connects the hosted, read-only `npmscan` MCP server (`https://npmscan.com/api/mcp`, no sign-in or API key) for npm supply-chain checks: malware, known vulnerabilities (OSV.dev, GitHub Security Advisories, NVD), typosquats, maintainer takeovers, install scripts and publish provenance.

**Skills:**

- `dependency-audit` - Audit a package.json, lockfile or SBOM for vulnerable and risky dependencies
- `package-trust-check` - Check whether one package is trustworthy: maintainer changes, provenance and install scripts
- `new-dependency-evaluation` - Compare candidate packages before adding a new dependency
- `incident-response` - Turn a flagged or suspicious package into concrete remediation steps
- `ci-pr-gate` - Give a PASS/WARN/FAIL verdict for a dependency change in a PR

## Plugin Structure

Each plugin follows the Factory plugin format:
Expand Down