supply-chain

Checks npm/pip dependencies for known vulnerabilities, typosquatting, and malicious packages. Use before adding new dependencies or during security audits. Don't use for runtime monitoring.