npm▌

Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to identify recently created packages mimicking established ones, and flagging download count anomalies where suspicious packages have disproportionately low usage compared to their legitimate targets. The analyst queries the PyPI JSON API and npm registry API to gather package metadata for automated comparison. Activates for requests involving package typosquatting detection, dependency confusion analysis, malicious package identification, or software supply chain threat hunting in package registries.

Install, authenticate, and verify the @auto.dev/sdk npm package so a downstream agent can run any Auto.dev automotive data task (VIN decode, listings, photos, specs, recalls, payments, APR, TCO, plate-to-VIN, taxes) via the global `auto` CLI, the bundled stdio MCP server, or the JS/TS SDK.

Inspect npm package tarball contents before publishing to verify what files will be distributed. \n \n Lists exact files that would be uploaded to npm, helping catch missing or unwanted inclusions before publish \n Respects files field in package.json, .npmignore , and .gitignore rules to show the actual bundle contents \n Automatically builds the package, creates a tarball, displays contents, and cleans up in a single command \n Run from the package directory with a simple bash script; useful f

Install npm packages directly from GitHub repositories using git URLs. \n \n Supports HTTPS and SSH methods for public and private repositories, with authentication via SSH keys or personal access tokens \n Install from specific branches, tags, commits, or the default branch by appending #<ref> to the git URL \n Automatically runs the prepare script during installation, enabling TypeScript compilation and builds for packages not yet published to npm \n Add git URLs directly to package.json

Use this skill whenever: