Dependency Audit

The Problem

Your code might be secure, but your dependencies aren’t necessarily. One vulnerable package in your dependency tree can expose your entire application. Supply chain attacks — malicious packages with typosquatted names, compromised maintainer accounts, hidden postinstall scripts — are increasing every year. You need a way to evaluate your dependency health beyond just running npm audit.

The Prompt

Audit my project's dependencies for security, maintenance, and supply chain risks.

PACKAGE FILE:
[paste your package.json, requirements.txt, go.mod, or Gemfile here]

LOCK FILE (if available):
[paste relevant sections of package-lock.json, yarn.lock, etc.]

Analyze each dependency for:

1. **Known Vulnerabilities** — Any CVEs or security advisories?
2. **Maintenance Status** — Last publish date, open issues, maintainer activity
3. **Popularity & Trust** — Download count, GitHub stars, corporate backing
4. **Supply Chain Risk** — Typosquatting potential, excessive transitive deps, postinstall scripts
5. **Version Freshness** — How far behind the latest stable release?
6. **Redundancy** — Multiple packages doing the same thing?
7. **License Compatibility** — Any GPL or restrictive licenses that conflict with the project?

Provide a risk summary table and flag anything that needs immediate action.
Suggest safer alternatives for any high-risk dependencies.

Example Output

## Dependency Audit: 2 critical, 1 warning, 14 healthy

| Package         | Version | Latest | Risk    | Issue                           |
|-----------------|---------|--------|---------|---------------------------------|
| lodash          | 4.17.20 | 4.17.21| WARNING | Known prototype pollution CVE   |
| express         | 4.18.2  | 4.21.0 | OK      | Stable, well-maintained         |
| event-stream    | 3.3.4   | —      | CRITICAL| Compromised in supply chain attack |
| node-uuid       | 1.4.8   | —      | CRITICAL| Deprecated — use `uuid` instead |

### Immediate Actions
1. Remove `event-stream` — compromised package, use `Highland.js` or native streams
2. Replace `node-uuid` with `uuid@9.x` (the official maintained fork)
3. Update `lodash` to 4.17.21 to patch CVE-2021-23337

When to Use

Run this whenever you add new dependencies, during periodic security reviews, or after a Dependabot alert. Especially important before deploying to production or when inheriting a project with unfamiliar dependencies. Make it part of your monthly maintenance routine.

Pro Tips

• Include your lock file — it reveals the full transitive dependency tree where most vulnerabilities actually hide.
• Ask about alternatives — follow up with “What’s the most lightweight, secure alternative to [package] that does the same thing?” to reduce your attack surface.
• Check postinstall scripts — ask AI to flag any packages that run code during installation: “Which of these packages have postinstall scripts and what do they do?”