npm Lockfile Security Auditor

NPM Lockfile Threat Scanner – Compromised Package Checker

halcyon_twine/npm-lockfile-threat-scanner

Check package-lock.json, yarn.lock or pnpm-lock.yaml for known-malicious (compromised) package versions — supply-chain attack triage in seconds, no install needed.

Crawls public websites to detect AI chat widgets and audits them for prompt injection, instruction leakage, and agent security risks.

🛡️ Audit MX, SPF, DMARC, DKIM, MTA-STS, TLS-RPT, BIMI, CAA, DNSSEC, and web TLS without sending email. Get evidence-backed security and deliverability scores, prioritized fixes, and a client-ready report.

Package Security & License Auditor MCP Server. Check package licenses, known vulnerabilities, and metadata across npm, PyPI, and Cargo ecosystems — all from your AI agent. Tools check_package — License, version, description, maintainers audit_vulns — Known CVEs via OSV.dev database

DepGuard MCP — Dependency Vulnerability Scanner

snipr/depguard-mcp

MCP server that stops AI coding agents from installing vulnerable packages. Checks any package against OSV.dev, or scans an entire lockfile (npm, PyPI, Cargo, Go & more) in one call — with severity thresholds, banned packages and triaged-CVE waivers.

Dockerfile Linter — Security & best-practices checker

perryay/dockerfile-linter-checker

Lint Dockerfiles and docker-compose files against 15+ security and best-practice rules. Detects running as root, missing USER directive, unpinned packages, missing HEALTHCHECK, and more. Supports strict mode and batch linting.

npm License & Deprecation Checker

taroyamada/npm-package-intelligence

Audit npm libraries for deprecated versions, abandoned repositories, and specific open-source licenses to maintain healthy JavaScript supply chains.

Scan npm, PyPI, Maven, Go & more dependencies for known vulnerabilities via OSV.dev and the GitHub Advisory Database. CI/CD-ready, no login.

DepGuard - Dependency Vulnerability Scanner

george.the.developer/depguard-dependency-vulnerability-scanner

Scan your dependencies for known vulnerabilities over OSV.dev and flag the ones CISA lists as actively exploited, so you patch the dangerous bugs first. Packages or a lockfile in, normalized vulnerability rows out. No API key, standby ready.

SBOM Vulnerability Scanner — Lockfile CVE Scan (OSV/KEV)

malonestar/sbom-vulnerability-rollup

SBOM vulnerability scanner: paste an npm, pip or go lockfile and get a prioritized CVE report with upgrade targets. Batch-queries OSV.dev, flags CISA KEV known-exploited vulns, adds NVD CVSS, and computes the minimum fix version per package plus a severity rollup. Keyless.