{
  "markdown": "# 🛡️ dx-guard\n\n**Dependency security guard for AI coding agents.**\n\ndx-guard automatically scans npm and Python packages for known vulnerabilities before your AI coding agent installs them. Zero config. Zero API keys. Powered by [OSV.dev](https://osv.dev).\n\n## Why?\n\nAI coding agents (Claude Code, Cursor, Copilot) install packages autonomously. When a vibecoder says \"build me a todo app\", the agent pulls in 15+ dependencies without human review. Supply chain attacks like the [Axios compromise (March 2026)](https://www.huntress.com/blog/supply-chain-compromise-axios-npm-package) show how dangerous this can be.\n\ndx-guard adds a security checkpoint before every install — automatically.\n\n## How it works\n\n```\nYou: \"build me a chat app\"\nClaude: npm install express socket.io ...\n\n[dx-guard] 🔍 Scanning dependencies...\n[dx-guard] ✅ express — clean\n[dx-guard] ⚠️  socket.io — 2 known vulnerabilities [GHSA-xxxx, GHSA-yyyy]\n[dx-guard] ⚡ Proceeding — review the warnings above.\n```\n\nFor **malicious packages**, dx-guard blocks the install entirely:\n\n```\n[dx-guard] 🚨 MALICIOUS: evil-package — known malicious package!\n[dx-guard] ❌ Install BLOCKED.\n```\n\n## Install\n\n### Claude Code Plugin (recommended)\n\nRun these three commands inside Claude Code:\n\n```\n/plugin marketplace add iamdxcom/dx-guard\n/plugin install dx-guard@iamdxcom-dx-guard\n/reload-plugins\n```\n\nThat's it. dx-guard is now active for all Claude Code sessions.\n\n> **Note:** Once dx-guard is published to the official Claude plugin store, you'll be able to install it with a single command: `claude plugin add dx-guard`\n\n### Manual setup\n\nCopy `hooks/scan.sh` to your project and add to your agent's hook config:\n\n**Claude Code** (`.claude/settings.json`):\n```json\n{\n  \"hooks\": {\n    \"PreToolUse\": [{\n      \"matcher\": \"Bash\",\n      \"hooks\": [{\n        \"type\": \"command\",\n        \"command\": \"./hooks/scan.sh\",\n        \"timeout\": 15\n      }]\n    }]\n  }\n}\n```\n\n## Features\n\n- **Pre-install scanning** — checks packages BEFORE they're installed\n- **Multi-ecosystem** — npm, pnpm, yarn, bun, pip, uv\n- **Malicious package detection** — blocks known malware\n- **Vulnerability reporting** — warns about known CVEs\n- **Zero config** — no API keys, no accounts, no setup\n- **Fast** — parallel OSV.dev queries, 15s timeout\n- **Non-blocking for clean packages** — zero overhead when everything is safe\n\n## Slash Commands\n\n| Command | Description |\n|---------|-------------|\n| `/dx-guard:scan` | Scan current project's dependencies |\n\n## Requirements\n\n- `bash`, `curl`, `jq` (available on most systems)\n- Internet access (to query OSV.dev)\n\n## Data Source\n\ndx-guard uses [OSV.dev](https://osv.dev), Google's open-source vulnerability database that aggregates data from GitHub Security Advisories, PyPA, NVD, and more. No API key required. No rate limits.\n\n## Roadmap\n\n- [ ] Typosquatting detection (Levenshtein distance)\n- [ ] Package age check (block recently published packages)\n- [ ] Cursor / Windsurf / Copilot plugin packaging  \n- [ ] Dashboard at iamdx.com\n- [ ] Team policy engine\n\n## License\n\nMIT\n\n## Author\n\n[Onur Erkan](https://iamdx.com)\n",
  "bytes": 3100,
  "sha": "7b8c4903580bbef3e51bb12d0058b7b2bf964923756449d751b750a0c4ba0122",
  "repo_slug": "iamdxcom/dx-guard",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_iamdxcom_dx_guard_dx_guard_74ffae90/readme"
}