npm-supply-chain-incident-response - Investigate and contain npm supply-chain incidents
Investigate and contain npm supply-chain compromises with version-scoped evidence, exposure analysis, safe tarball inspection, and deprecation.
Tags
Updated: 2026-09-24Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Collect npm package registry metadata
- Analyze local and CI exposure
- Inspect package tarballs safely
- Classify security exposure levels
- Deprecate compromised npm package versions
- Manage npm package maintainer access
Inputs
- Package name and affected versions
- Security advisory URLs and screenshots
- Target npm registry configuration
- Local installation and CI run dates
- Package manager and lockfile types
- Credential storage location details
Outputs
- Deprecated npm registry package versions
- Updated npm dist-tags
- Modified package maintainer ownership
- Saved incident artifacts and tarballs
Requirements
- npm CLI
- pnpm CLI
- tar and sha256sum tools
- npm package maintainer access