NPMScan
Check npm packages for malware, known vulnerabilities, typosquats and maintainer takeovers before installing, via npmscan.com's free, read-only MCP server (23 tools, no API key).
Open the project ↗Is this your plugin? Get featured or get a Verified badge ($9/mo) →
Is this your plugin? Claim this listing.
Tell us it's yours and what to fix. Claiming is free. We'll check that you own or maintain the repo before changing anything.
Paste this into your README:
[](https://pickaplugin.com/p/npmscan)
Also in Security & Governance
Guards, audits and policy.Agent Guard
Local-by-default, no-telemetry hooks block or mask secret leaks in Claude Code and Codex, with opt-in PII filtering and Git/CI backstops.
No.034ArmorCodex
Intent-based security for Codex with MCP plan registration, policy gating, CSRG cryptographic proofs, and audit logging on `bash` and `apply_patch`.
No.039AxonFlow
Runtime governance for Codex with policy enforcement on terminal commands, advisory checks for non-terminal tools via skills, PII/secret detection, and compliance-grade audit trails. Self-hosted via Docker.
No.045BountyGuard
Pre-flight GitHub bounty security scanner and on-chain Proof-of-Escrow MCP verifier that classifies open bounties before AI agents invest compute.