package-risk-auditlisted

# package-risk-audit Decide whether a dependency is safe to take, keep, or drop. Aligns with OWASP Top 10 2025 A03 (software supply chain failures) and OSSF package-manager practice. ## Intake (new package) 1. Exact name and registry; prefer official source over mirrors. 2. Why this package beats a small in-repo implementation (cost of ownership). 3. Repo health: maintainers, release cadence, open critical issues, OpenSSF Scorecard if available. 4. Transitive size: what it pulls in; `deps.dev` or lockfile graph. 5. License compatible with the product license. 6. Pin strategy: exact version or lockfile hash; no floating `latest`. Reject or quarantine when: brand-new account, name within Levenshtein distance of a popular package with no clear link, install scripts that fetch remote binaries, or maintainers you cannot map to a known org. ## Typosquat and confusion - Compare the name to the intended package (edit distance, homoglyphs, extra suffixes like `-utils`, `-pro`). - Scope private packages (`@yorg/...`) so npm cannot silently resolve them from the public registry. - Disable “merge with upstream” on internal proxies; fail the build on 404 instead of falling back to public. - Claim the org name on public registries even if you only publish privately. Confusion attacks are mostly semantic; typos are only one mechanism. A rename that swaps one word (`discord.js` vs `discord.dll`) is a real flag. ## Vulnerability triage | Source | Use | |---|---| | OSV / GitHub Adviso