Model Context Protocol (MCP) Server: io.github.salemalem/npmscan
This MCP server detects malicious or vulnerable npm packages by performing registry search plus lookups against OSV.dev and GitHub advisories. It is identified by the slug io-github-salemalem-npmscan and focuses on gathering vulnerability and advisory information for npm package assessment.
🛠️ Key Features
- Detects malicious or vulnerable npm packages
- Performs registry search
- Looks up OSV.dev for vulnerability data
- Looks up GitHub advisories
🚀 Use Cases
- Checking npm packages for known vulnerabilities or malicious indicators
- Verifying whether a dependency appears in OSV.dev or GitHub security advisories
- Reviewing package risk during npm dependency management
⚡ Developer Benefits
- Integrates registry search with OSV.dev and GitHub advisory lookups
- Uses a single server endpoint for vulnerability/advisory retrieval for npm packages
⚠️ Limitations
- Source data does not specify additional tools, configuration options, or scanning behavior beyond registry search and OSV.dev/GitHub advisory lookups