A catalog of ChatGPT & Codex plugins, sorted by people.
NPMScan vs Fixlane
Two Security & Governance tools whose own descriptions overlap (shared terms: known, read-only). Here's what each project says it does and the public numbers, side by side, so you can pick one in a minute instead of reading two READMEs.
| NPMScan | Fixlane | |
|---|---|---|
| What it says it does | Check npm packages for malware, known vulnerabilities, typosquats and maintainer takeovers before installing, via npmscan.com's free, read-only MCP server (23 tools, no API key). | Known security issues in developer software with reviewed fix procedures: checks your installed tools and versions read-only. Remote MCP server plus plugin for Claude and Codex. |
| Maker | salemalem | Fixlane (LightSmite) |
| GitHub stars | 504 | 0 |
| Last push | pushed 2026-11-15 (this week) | pushed 2026-11-11 (this week) |
| License | MIT | MIT |
| Language | TypeScript | n/a |
| Packaged as | MCP server, plugin | MCP server, plugin |
| Works with | Claude Code | Codex, Claude Code |
| Install | /plugin marketplace add salemalem/npmscan-mcp-plugin | /plugin marketplace add lightsmite/fixlane-plugin |
| Editor's pick | No | No |
| In our catalog since | 2026-10-26 | 2026-11-11 |
| Source | github.com/salemalem/npmscan-mcp-plugin | github.com/lightsmite/fixlane-plugin |
| Our page | NPMScan → | Fixlane → |
The differences that matter
- Attention: NPMScan has 504 GitHub stars to Fixlane's 0.
- Activity: NPMScan was pushed more recently (2026-11-15 vs 2026-11-11).
- License: both MIT.
Who each one suits
NPMScan, if…
- You use Claude Code: the project's own description or install command targets it.
- You want something you install yourself; the install command doesn't point at a hosted endpoint.
- You need a permissive license (MIT) for work or commercial use.
- You want a project that's actively being worked on right now.
- You'd rather go with a widely watched project (504 stars).
Fixlane, if…
- You use Codex or Claude Code: the project's own description or install command targets it.
- You want something you install yourself; the install command doesn't point at a hosted endpoint.
- You need a permissive license (MIT) for work or commercial use.
- You want a project that's actively being worked on right now.
- You're happy to be an early user of a small project.
So which one?
We haven't run both, so we won't crown a winner. Use the list above to rule one out, then read its README and recent commits before installing. Anything that runs commands on your machine deserves a look at the code.
Related
NPMScan alternatives · Kanareika vs Fixlane
More: Security & Governance plugins · best Security & Governance plugins, ranked · all comparisons
Data from GitHub and each project's README, checked 2026-11-15. We haven't installed or audited these, and stars measure attention, not quality. Paid placements never change this page. Spot a mistake? hello@pickaplugin.com
New MCP servers & plugins, once a week
One short email a week: the MCP servers and plugins that joined the catalog, and the ones gaining stars fastest. Free. Confirm by email, unsubscribe in one click. Past issues.
