[salemalem]

Disclosure up front: I maintain npmscan and npmscan-action, so I have an interest in this. If it isn't a fit, please close it, no hard feelings.

What this does

Following up on #1628 (supply-chain analysis for tedious). Socket needs a GitHub App that only an org admin can install. This is the same kind of check, but as one workflow file you can review and merge like any other change.

It adds .github/workflows/npmscan.yml, which runs npmscan-action on pull requests that touch package.json or package-lock.json. It diffs both files between the PR base and head, and flags only what changed:

• a dependency that newly runs an install script (preinstall/install/postinstall), the usual sign of a hijacked package
• a lockfile entry whose version stays the same but whose tarball or integrity changes
• added or changed overrides, and changes to the root package's own lifecycle scripts
• known vulnerabilities and known malware in newly introduced versions

Overlap with what you already run

• Your npm audit signatures step should already fail a build once a swapped registry tarball gets installed. This check reports the same kind of swap on the PR diff before anything is installed, and it also covers install-script and overrides changes, which signature checks don't look at.
• Dependabot keeps advisories up to date for what's already in the tree. This only looks at what a PR changes.

Tested on this repo

I replayed tedious's own history through the same API the action calls:

• The latest real lockfile change (fd1149d: 1 added, 6 changed) parses and nothing is flagged, so a normal update stays quiet.
• In a tampered copy of the current lockfile, @azure-rest/core-client@2.4.0 keeps its version but has a different integrity. It's flagged as a repointed entry.

Configuration

• Never blocks: mode: warn and fail-on-error: false. If npmscan.com is down, the job reports a warning and passes.
• Quiet: it only runs when package.json or package-lock.json changes (plus this workflow, so you can see it run here). comment: on-findings means a PR comment appears only when something is flagged. The full report always goes to the job summary.
• Least privilege: permissions: {} at the top, and the job gets only contents: read and pull-requests: write. Checkout uses persist-credentials: false. Both actions are pinned to full commit SHAs, with a timeout-minutes: 15 cap.
• What leaves the runner: only the two scanned files, from the base and head commits, go to https://npmscan.com/api/analysis/dependency-diff. Never source code, secrets or the token. Nothing is stored. Package names and versions from the diff are then looked up on the public npm registry and OSV.dev. Details: What leaves your runner.

PR template notes

This only adds a workflow file, so there's no code to build, test or lint (template steps 2–5 don't apply). The title follows Conventional Commits.