Audits your package-lock.json for supply-chain attacks before install. Cross-checks every resolved entry against the live npm registry to detect integrity mismatches, new install scripts, and other malicious signals.
Provides the real exported API surface and type signatures of any npm package, extracted from its published TypeScript declarations, enabling AI coding agents to use functions accurately and avoid inventing nonexistent APIs.
Validates release hygiene in local repositories with network-free, read-only tools for checking repo structure, version alignment, and generating release checklists.