English Français العربية

npm Supply Chain Audit

Official registry Developer tools

Check npm packages for typosquats, hallucinated names, install scripts and risky new releases.

Source code Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http npm-supply-chain-audit 'https://npm-supply-chain-audit-mcp.mcpize.run/mcp'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "npm-supply-chain-audit": {
            "type": "http",
            "url": "https://npm-supply-chain-audit-mcp.mcpize.run/mcp"
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. npm-supply-chain-audit-mcp
  2. What it catches
  3. Tools
  4. Use it
  5. Part of a small suite
  6. License
  7. Update 1.1.0 (2026-10-01)

npm-supply-chain-audit-mcp

An MCP server that audits package.json for the real mechanisms behind actual npm supply-chain incidents — typosquatting and malicious install scripts — not a generic vulnerability-database lookup.

What it catches

Typosquatting. Dependency names within 1-2 character edit distance of one of the npm registry's most-depended-on packages (lodash, express, react, axios, and ~90 others) — the actual real targets of typosquat campaigns, since attackers go after the packages with the largest install base. lodahs, expres, reqeust all flag; an unrelated, genuinely distinct package name doesn't.

Malicious install scripts. preinstall/install/postinstall hooks run automatically on npm install, before any of the package's own code is ever reviewed — the actual delivery mechanism behind real incidents (event-stream 2018, ua-parser-js 2021, and others since). Flags scripts that pipe a remote download directly into a shell, and scripts that decode an obfuscated base64 payload before running it.

Unpinned versions. Dependencies on * or latest pull in whatever gets published next, silently, with no diff in your repo to explain why your dependency tree changed.

Tools

audit_package_json

Full audit of a package.json file.

check_package_name

Focused typosquat check on a single package name.

Use it

Hosted (recommended): MCPize — free tier, $7/mo Pro.

Self-host:

npm install
node server.js

Part of a small suite

secrets-leak-audit-mcp, mcp-trust-audit-mcp, github-actions-audit-mcp, dockerfile-audit-mcp.

License

MIT

Update 1.1.0 (2026-10-01)

  • New tools inspect_package_live and audit_dependencies_live: look packages up on the live npm registry. Flags names that do not exist (hallucinated or mistyped), brand-new low-traffic packages, install scripts, deprecated releases and typosquats.

Frequently asked questions

What is npm Supply Chain Audit?

Check npm packages for typosquats, hallucinated names, install scripts and risky new releases.

How do I install npm Supply Chain Audit?

It runs as a remote server. In Claude Code: claude mcp add --transport http npm-supply-chain-audit 'https://npm-supply-chain-audit-mcp.mcpize.run/mcp'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does npm Supply Chain Audit need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is npm Supply Chain Audit open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains npm Supply Chain Audit?

It is published by tylerscomic-lab. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.