NPMScan plugin for Codex
Detect malicious, vulnerable, or typosquatted npm packages from a conversation. Search the npm registry, or compare 2-5 candidates side-by-side before adding a new dependency; inspect maintainers, install scripts, and Sigstore publish provenance before installing; audit a whole package.json/lockfile/SBOM/GitHub repo — including transitive dependencies, license compliance, and before/after PR diffs or npm audit output — against OSV.dev / GitHub Security Advisories / NIST NVD (with CISA KEV and FIRST EPSS enrichment); then get a prioritized remediation ranking, concrete incident-response playbooks, a CI-ready PASS/WARN/FAIL merge gate, safer-alternative suggestions, and a generated CycloneDX/SPDX SBOM — via npmscan.com's free, read-only MCP server.
How to install NPMScan in Codex
1. Add the repo as a Codex plugin marketplace:
codex plugin marketplace add salemalem/npmscan-mcp-plugin2. Install the plugin from it:
codex plugin add npmscan@npmscanThis repo ships a Codex marketplace file (.agents/plugins/marketplace.json). The first command adds it as a marketplace (Codex CLI reference); the second installs the plugin 'npmscan'. 'npmscan' is the marketplace name from that file. Check the repo README too. Command format: Codex CLI reference.
New Codex plugins every Tuesday, install line ready to copy.
Stacks Weekly is one short email from GrokStacks and CodexStacks. Subscribe and get the free starter list: 20 Codex plugins worth installing first.
Confirmation email first. Unsubscribe anytime.
What it contains
Plugins in this marketplace (1)
npmscan— Detect malicious, vulnerable, or typosquatted npm packages from a conversation. Search the npm registry, or compare 2-5 candidates side-by-side before adding a new dependency; inspect maintainers, install scripts, and Sigstore publish provenance before…
Example prompts from the manifest
- Check if the npm package lodash is safe to install
- Audit the package.json in my project for vulnerabilities
- Compare axios vs node-fetch before I add a dependency
About this listing
NPMScan is a community plugin on GitHub by salemalem. Its README documents a Codex install and the repo ships a Codex plugin manifest. It passed the CodexStacks quality filter for repos found this way (at least 100 stars, pushed in the last 90 days, not a fork or a list). OpenAI hasn't reviewed it, but it passed our Codex install check on Oct 29, 2026 (an install and load check, not a code review). From its files we found 1 plugin. The manifest says version 3.1.2. It's one of 441 listings in the Developer Tools category. It also appears in best Codex plugins for security.
NPMScan FAQ
How do I install NPMScan in Codex?
Add the repo as a Codex plugin marketplace with codex plugin marketplace add salemalem/npmscan-mcp-plugin, then install it with codex plugin add npmscan@npmscan. Commands: the command format from the Codex CLI reference; check the repo README too.
Is NPMScan an official Codex plugin?
No. NPMScan is a community repo on GitHub by salemalem. It passed the CodexStacks quality filter, but OpenAI hasn't reviewed it, but it passed our Codex install check on Oct 29, 2026 (an install and load check, not a code review), so read the code before you install it.
What does NPMScan include?
From its manifest and repo files, NPMScan includes 1 plugin: npmscan.
Details
- Type
- Plugin
- Category
- Developer Tools
- Source
- Community
- Author
- BlockHacks.io
- Version
- 3.1.2
- License
- MIT
- GitHub stars
- 480 (at last sync)
- Last push
- 2026-10-29
- Manifest
.agents/plugins/marketplace.json- GitHub topics
- gemini-cli-extension, mcp, npm, security, supply-chain-security
- Source
- https://github.com/salemalem/npmscan-mcp-plugin
- Listed via
- GitHub search: README documents a Codex install
- Install check by CodexStacks
- Passed on Oct 29, 2026 with Codex CLI 0.163.0: Codex started its MCP server and listed its tools. proof · how we check
Something wrong or missing? Submit or improve this listing. Listings also refresh automatically every night.
For maintainers: badge and embeds
Maintain NPMScan? Add the badge; it links to this page.
Markdown
[](https://codexstacks.com/p/npmscan-mcp-plugin/)HTML
<a href="https://codexstacks.com/p/npmscan-mcp-plugin/"><img src="https://codexstacks.com/badge.svg" alt="Listed on CodexStacks" width="172" height="28"></a>Embed card (static HTML and inline CSS, no JavaScript). Preview:
<a href="https://codexstacks.com/p/npmscan-mcp-plugin/" style="display:block;max-width:380px;box-sizing:border-box;padding:14px 16px;border:1px solid #3a2c26;border-radius:12px;background:#0d0b0a;color:#f3ece6;font:14px/1.45 -apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;text-decoration:none"><span style="display:block;font-size:16px;font-weight:700;color:#f3ece6">NPMScan</span><span style="display:block;margin:2px 0 8px;font-size:12px;color:#b5a9a1">Community Codex plugin · 1 plugin</span><span style="display:block;margin:0 0 10px;color:#ddd3cc">Detect malicious, vulnerable, or typosquatted npm packages from a conversation. Search the npm registry, or compare…</span><span style="font-size:12px;font-weight:600;color:#ffb347">View on CodexStacks →</span></a>Markdown summary
**[NPMScan on CodexStacks](https://codexstacks.com/p/npmscan-mcp-plugin/)**: Community Codex plugin with 1 plugin.More on badges, embeds and keeping your listing up to date: CodexStacks for plugin authors.
Also in Developer Tools
Rea
Reverse engineer anything with agents, from app behavior down to native binaries.
Skills (mattpocock)
Skills for Real Engineers. Straight from my .agents directory.
Agents
Multi-harness agentic plugin marketplace for Claude Code, Codex, Cursor, OpenCode, GitHub Copilot, Google Antigravity, and Pi
Playwright MCP
Playwright MCP server
Nuwa Skill
你想蒸馏的下一个员工，何必是同事。蒸馏任何人的思维方式——心智模型、决策启发式、表达DNA。Distill how anyone thinks.
Oh My Codex
OmX - Oh My codeX: Your codex is not alone. Add hooks, agent teams, HUDs, and so much more.