Initial release

npmscan Dependency Check v1.0.0

First release. Scans the package.json or lockfile changes in a pull request with npmscan.com and reports risky packages before they're merged.

What it flags

• Known vulnerabilities in added or upgraded packages, with severity
• Newly introduced install scripts (preinstall / install / postinstall)
• Changed package source or integrity hash, such as a lockfile entry pointing at a different tarball with the same version

What you get on the PR

• A comment with a table of flagged packages, each linking to its npmscan.com page, updated in place on every push
• The same report in the workflow's job summary
• A failing check when anything is flagged (turn this off with fail-on-flagged: false)

Supported files

package.json, package-lock.json, yarn.lock (classic and Berry), pnpm-lock.yaml

Quick start

name: npmscan
on:
  pull_request:
    paths: [package.json, package-lock.json, yarn.lock, pnpm-lock.yaml]
permissions:
  contents: read
  pull-requests: write
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: npmscan/npmscan-action@v1

Known limitations

• PRs from forks get a read-only token, so the PR comment is skipped; the report still appears in the job summary.
• No API key needed. Requests share npmscan.com's public rate limit.