# check-npm

> Claude/Codex skill by [@grafana](https://omgskills.com/library/grafana/index.md) · 286 stars · Updated 2026-10-17

Audit a JavaScript/TypeScript repo's npm, yarn, or pnpm configuration for supply-chain hardening: tool version, lifecycle scripts, unsafe dependency protocols, and minimum release age ≥3 days. Use when the user invokes /check-npm or asks to audit package manager security, lifecycle scripts, git dependencies, ignore-scripts, min-release-age, allow-git, approvedGitRepositories, strictDepBuilds, or blockExoticSubdeps in a Grafana plugin or JS/TS project.

## Install

```sh
git clone https://github.com/grafana/skills /tmp/skills && ln -s /tmp/skills/skills/grafana-plugins/check-npm ~/.claude/skills/check-npm
```

## From README

npm / yarn / pnpm supply-chain audit Read-only audit of the workspace root. Do not modify any files. Detect package manager If no package.json, stop. Priority: packageManager → lockfile → default npm. Tool version Use semver comparison. Verify pinned packageManager meets threshold. | Manager | Minimum | |---------|---------| | npm | 11.15.0 | | yarn | 4.14.0 | | pnpm | 11.0.0 | Lifecycle scripts disabled | Manager | PASS | FAIL | |---------|------|------| | npm | .npmrc has ignore-scripts=true | missing or false | | yarn | enableScripts: false or key absent | enableScripts: true | | pnpm ≥ 11 | strictDepBuilds unset/true, dangerouslyAllowAllBuilds unset/false, and allowBuilds unset/\[\] | strictDepBuilds: false, dangerouslyAllowAllBuilds: true, or allowBuilds non-empty | | pnpm 10 | .npmrc ignore-scripts=true OR strictDepBuilds: true | neither | pnpm 11+ ignores script settings in .npmrc and package.json\#pnpm. pnpm 10 / yarn edge cases: references/managers.md.

## Links

- HTML page: https://omgskills.com/library/grafana/skills/check-npm/
- GitHub: https://github.com/grafana/skills
- Author: [@grafana](https://omgskills.com/library/grafana/index.md)

## More from this repo

- [k6-docs](https://omgskills.com/library/grafana/skills/k6-docs/index.md) — Used to write or review k6 documentation across the three k6 repositories - k6-DefinitelyTyped (TypeScript types),...
   - [@grafana](https://omgskills.com/library/grafana/index.md) · 295 stars
- [adaptive-metrics](https://omgskills.com/library/grafana/skills/adaptive-metrics/index.md) — Cut Grafana Cloud Metrics cost by shrinking active-series count with Adaptive Metrics aggregation rules —...
   - [@grafana](https://omgskills.com/library/grafana/index.md) · 286 stars
- [admin](https://omgskills.com/library/grafana/skills/admin/index.md) — Used to manage Grafana Cloud accounts — organizations, stacks, RBAC roles and assignments, SSO/SAML/OAuth/GitHub auth,...
   - [@grafana](https://omgskills.com/library/grafana/index.md) · 286 stars