By onurerkan
Dependency security guard for AI coding agents. Scans npm/pip/pnpm/yarn packages for known vulnerabilities before installation using OSV.dev — zero config, zero API keys.
Dependency security guard for AI coding agents.
dx-guard automatically scans npm and Python packages for known vulnerabilities before your AI coding agent installs them. Zero config. Zero API keys. Powered by OSV.dev.
AI coding agents (Claude Code, Cursor, Copilot) install packages autonomously. When a vibecoder says "build me a todo app", the agent pulls in 15+ dependencies without human review. Supply chain attacks like the Axios compromise (March 2026) show how dangerous this can be.
dx-guard adds a security checkpoint before every install — automatically.
You: "build me a chat app"
Claude: npm install express socket.io ...
[dx-guard] 🔍 Scanning dependencies...
[dx-guard] ✅ express — clean
[dx-guard] ⚠️ socket.io — 2 known vulnerabilities [GHSA-xxxx, GHSA-yyyy]
[dx-guard] ⚡ Proceeding — review the warnings above.
For malicious packages, dx-guard blocks the install entirely:
[dx-guard] 🚨 MALICIOUS: evil-package — known malicious package!
[dx-guard] ❌ Install BLOCKED.
Run these three commands inside Claude Code:
/plugin marketplace add iamdxcom/dx-guard
/plugin install dx-guard@iamdxcom-dx-guard
/reload-plugins
That's it. dx-guard is now active for all Claude Code sessions.
Note: Once dx-guard is published to the official Claude plugin store, you'll be able to install it with a single command:
claude plugin add dx-guard
Copy hooks/scan.sh to your project and add to your agent's hook config:
Claude Code (.claude/settings.json):
{
"hooks": {
"PreToolUse": [{
"matcher": "Bash",
"hooks": [{
"type": "command",
"command": "./hooks/scan.sh",
"timeout": 15
}]
}]
}
}
| Command | Description |
|---|---|
/dx-guard:scan | Scan current project's dependencies |
bash, curl, jq (available on most systems)dx-guard uses OSV.dev, Google's open-source vulnerability database that aggregates data from GitHub Security Advisories, PyPA, NVD, and more. No API key required. No rate limits.
MIT
Executes bash commands
Hook triggers when Bash tool is used
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
npx claudepluginhub onurerkan/dx-guard --plugin dx-guardSafety for Agents - Agent Detection & Response (ADR) for AI agents
Offline security scanner for AI-agent repos, skills, plugins, and MCP servers
Comprehensive vulnerability scanning for code, dependencies, and configurations with CVE detection
Audit supply-chain threat landscape of project dependencies for exploitation or takeover risk
DevsForge Enterprise Dependency Management Architect delivering comprehensive package optimization, vulnerability management, and license compliance frameworks that transform dependency management from operational task into strategic business value creation and security excellence catalyst
Security skills for AI coding agents — supply chain incident response, credential rotation, IOC detection, and dependency hardening across npm, PyPI, GitHub Actions, and more