Dependency Supply Chain Security
Helps Claude understand and check your dependency tree for supply chain risks when you're working with npm packages. You'd reach for this when auditing a project's dependencies, investigating a specific package before adding it, or trying to spot malicious code in your node_modules. The skill draws on real attack patterns like the event-stream incident and focuses on the fact that your average app pulls in 200+ direct dependencies, each with around 5 transitive deps. It's education mixed with practical checks. Given the 700% spike in supply chain attacks mentioned in the 2024 Sonatype report, this is less about paranoia and more about basic hygiene.
- skills.sh installs
- 253
- GitHub stars
- 18
- last updated
- Aug 21, 2026
Install
$ npx -y skills add harperaa/secure-claude-skills --skill dependency-supply-chain-security --agent claude-codeInstalls into .claude/skills of the current project.
Files
Dependency & Supply Chain Security
The Dependency Risk
Your application includes hundreds of npm packages. Each one is code written by someone else that runs in your application with full privileges.
The Statistics Are Sobering
According to Sonatype's 2024 State of the Software Supply Chain Report:
- 245,000 malicious packages published to npm (2023)
- 700% increase in supply chain attacks (vs 2022)
- Average application has 200+ dependencies
- Each dependency averages 5 transitive dependencies (dependencies of dependencies)
Real-World Supply Chain Attacks
event-stream Incident (2018): A popular npm package (2 million downloads/week) was hijacked. The attacker added code that stole cryptocurrency wallet keys. Thousands of applications were affected before discovery.
ua-parser-js Incident (2021): Package with 8 million weekly downloads was compromised. Attackers added cryptocurrency mining and password-stealing code.
colors.js / faker.js Incident (2022): Maintainer intentionally corrupted packages in protest. Millions of applications broke. Demonstrated single-point-of-failure risk.
Our Dependency Security Architecture
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/harperaa/secure-claude-skills
- Category
- Security
- First seen
- Jun 3, 2026
More from harperaa/secure-claude-skills
All 12- Csrf Protection206
- Security Headers203
- Security Architecture Overview200
- Rate Limiting199
- Security Testing Verification198
- Input Validation Xss Prevention197
- Secure Error Handling197
- Security Prompts193
- Authentication Authorization Clerk187
- Payment Security Clerk Billing Stripe183
- Security Operations Deployment165
Recommended
More Security
security-headersharperaa/secure-claude-skillsConfigure security headers to defend against clickjacking, XSS, MIME confusion, and SSL stripping attacks. Use this skill when you need to set up Content-Securi203skills.sh installssecurity-architecture-overviewharperaa/secure-claude-skillsUnderstand the defense-in-depth security architecture of Secure Vibe Coding OS. Use this skill when you need to understand the overall security approach, the 5-200skills.sh installs
alicloud-security-content-moderation-green-testcinience/alicloud-skillsSmoke test for alicloud-security-content-moderation-green. Validate minimal authentication, API reachability, and one read-only query path.160skills.sh installsalicloud-security-id-verification-cloudauth-testcinience/alicloud-skillsSmoke test for alicloud-security-id-verification-cloudauth. Validate minimal authentication, API reachability, and one read-only query path.156skills.sh installs
ai-securityhypnguyen1209/offensive-claudeAI/ML security assessment — prompt injection, jailbreak detection, RAG poisoning, model extraction, adversarial examples, supply chain risks in ML pipelines0skills.sh installsvulnerability-analysishypnguyen1209/offensive-claudeExpert-level source code security auditing — taint analysis, memory safety, injection classes, auth flaws, crypto weaknesses, concurrency bugs, supply chain ris0skills.sh installs