Agent Skills Index

Directory / Claude community plugins (Anthropic) / npm-postinstall-attack-scanner

npm-postinstall-attack-scanner

plugin Security

Detect npm supply chain attacks that use the postinstall + hidden dependency pattern to deliver malware. Built in response to the axios maintainer account takeover (2026-03-31). Scans lockfiles, ode_modules, postinstall scripts, version ranges, and npm cache across 5 phases. Returns actionable remediation steps when issues are found.
Description from the marketplace entry / plugin manifest.

Information source

Copied from the Claude community plugins (Anthropic) catalog (anthropics/claude-plugins-community), maintained by Anthropic (community submissions).

Links are pinned to commit 06ec7b6 (2026-10-13), the version we synced. Not reviewed by us.

Install

Add the marketplace (once, in Claude Code)
/plugin marketplace add anthropics/claude-plugins-community
In a Claude Code session
/plugin install npm-postinstall-attack-scanner@claude-community
From your shell
claude plugin install npm-postinstall-attack-scanner@claude-community

Commands follow each host's documentation (Claude Code, Claude Cowork docs). gh skill needs GitHub CLI 2.90 or later and is in public preview.

Listed from Anthropic (community submissions)'s catalog, not reviewed by us. Read the source before installing.

Catalog
Claude community plugins (Anthropic) (claude-community)
Information source
marketplace.json in anthropics/claude-plugins-community
Author
Not stated in the source
Source code
aliksir/npm-postinstall-attack-scanner
Homepage
github.com/aliksir/npm-postinstall-attack-scanner
License
MIT (repository license)
Repository stars
1 for aliksir/npm-postinstall-attack-scanner
Added to catalog
2026-04-07
Last change
2026-10-12 (last push to the repo)

What it contains

Hosted in an external repository, so contents are not counted here. See the source link.

Similar in Security