Audit Dependencies for Security and Compliance

Runs an 8-step dependency-security audit driven by a requirements argument. Dependency discovery across five ecosystems - npm via package.json, package-lock.json, and yarn.lock; Python via requirements.txt, Pipfile, pyproject.toml, and poetry.lock; Ruby via Gemfile; Java via pom.xml and build.gradle; and Go - with a DependencyDiscovery class that inventories direct and transitive packages. Vulnerability scanning against per-ecosystem databases (npm's security advisories bulk API, PyPI, RubyGems, and Sonatype's OSS Index for Maven) via a VulnerabilityScanner class that checks each package's name, version, and ecosystem and aggregates findings. License compliance reporting with a summary, license distribution, and flagged compliance issues. Outdated-dependency detection and dependency-size analysis. Supply-chain security checks for typosquatting (Levenshtein-distance comparison against a list of commonly typosquatted packages like react, express, lodash, and webpack), recent maintainer changes, and suspicious behavioral patterns in a package, each flagged with a severity and a specific recommendation. Automated remediation that auto-updates dependencies with available security fixes across NPM/Yarn and Python, generating a structured PR description separating security fixes from other updates, with a testing section and review checklist. Monitoring and alerts for ongoing dependency risk tracking. Outputs a standardized report: dependency summary and risk overview, vulnerabilities and license issues, recommended upgrades and mitigations, and assumptions plus follow-up tasks.

Use it when auditing dependencies for vulnerabilities, checking license compliance or supply-chain risk, identifying outdated packages and upgrade paths, or preparing a security report or remediation plan. Skip it when the project has no dependency manifests, you cannot change or update dependencies, or the task is unrelated to dependency management.

Input is a project path or dependency requirement passed as $ARGUMENTS; output is the standardized four-section report - summary and risk overview, vulnerabilities and license issues, recommended upgrades and mitigations, and assumptions and follow-up tasks - plus, where automated, a generated PR with security-fix updates and a review checklist.

Ecosystem package managers and lockfiles (npm/yarn, pip/Poetry, Bundler, Maven/Gradle, Go modules), vulnerability data sources (npm security advisories, PyPI, RubyGems, Sonatype OSS Index), and PR generation for NPM/Yarn and Python auto-updates.

Engineers and security teams auditing a project's dependency tree who need a structured vulnerability, license, and supply-chain report with concrete remediation steps rather than raw scanner output. The explicit safety instructions - never publish sensitive vulnerability details to public channels, and verify upgrades in staging before a production rollout - matter as much as the scanning itself.