depwarden: npm Supply-Chain Scanning That Includes AI Agent Config

Repo:* github.com/yaghobieh/depwarden · npm: depwarden (v1.0.1)

depwarden is a zero-config npm supply-chain guard for solo developers and small teams. Independent MIT project — not under @forgedevstack.

npx depwarden scan .

The problem

Lifecycle-script monitoring is incomplete.

The 2025–2026 worm wave showed self-propagating packages, secret harvesting, and persistence that survives npm uninstall when the backdoor lives in agent config: Cursor MCP/hooks, Claude Code settings, VS Code tasks, AGENTS.md, CI workflows.

Enterprise tools cover companies with budgets. Everyone else needed a free CLI with a real CI exit code that also scans the AI-agent surface.

Architecture in three scanners

depwarden scan .
├── manifest-audit   # lockfile / package.json hygiene + dangerous scripts
├── worm-ioc         # node_modules indicator patterns (detection only)
└── agent-config     # .cursor / .claude / .vscode / workflows / MCP

manifest-audit

Flags install scripts in dependencies, git/http deps that skip registry integrity, typosquat-suspect names (Levenshtein against a popular-packages list), freshly published versions, and dangerous commands in your own scripts (curl | bash, remote fetches).

worm-ioc

Looks for known worm-style indicators in node_modules: hashed IOCs, bundled secret-scanner markers, obfuscated payload patterns, remote-exec lifecycle scripts, undeclared binding.gyp. These are pattern matches, not proof of compromise.

agent-config (the AI-related core)

Scans:

• .cursor/mcp.json, hooks, rules
• .claude/, CLAUDE.md, AGENTS.md, related agent instruction files
• .vscode/tasks.json
• .github/workflows
• Continue / Windsurf / Codex style surfaces when present

Looks for unknown MCP binaries, untrusted MCP URLs, external hooks, auto-run tasks, known exfiltration domain families, and recently modified agent configs worth a human glance.

That is the AI link: agents expanded the trusted compute boundary into plain JSON and markdown sitting in the repo. depwarden watches those files the same way it watches install scripts.

CLI that fits CI

npx depwarden init                              # sample GitHub Action
npx depwarden scan . --fail-on high
npx depwarden scan . --format sarif > out.sarif
npx depwarden scan . --format annotations
npx depwarden scan . --scanners agent
npx depwarden scan . --watch --offline

Exit	Meaning
0	Nothing at or above --fail-on / --min-severity (default medium)
1	Findings at or above threshold
2	Usage or runtime error

What it is not

• Not a behavioral sandbox
• Not a compliance certificate
• Not an LLM product (no API key required for 1.0)
• Not ForgeStack — separate brand and repo on purpose

Optional future: LLM-assisted diff explanations for suspicious package upgrades. The shipped line is static tripwires.

Try it

npx depwarden scan .

• Source: https://github.com/yaghobieh/depwarden
• Package: https://www.npmjs.com/package/depwarden
• Deep dive: docs/depwarden.md and docs/usage.md in the repo