MANDATORY pre-installation security gate for open source packages. You MUST call this tool BEFORE running any package install command including: npm install, yarn add, pnpm add, pip install, poetry add, uv add, go get, cargo add, gem install, composer require, mvn dependency:resolve, or any other package manager install/add command. Call once for EACH package being directly installed. This tool checks packages for malware, supply chain attacks, and critical/high vulnerabilities. If the response status indicates the package is MALICIOUS or has CRITICAL vulnerabilities, you MUST REFUSE to install the package and inform the user of the security risk. Always follow the 'instruction' field in the response — it contains critical safety guidance.