[salemalem]

Adds NPMScan to Tools & Integrations (between NotFair Plugin and Nullcost). I maintain npmscan.

It checks npm packages for malware, known vulnerabilities, typosquats and maintainer takeovers before you install them. The plugin is five skills plus npmscan.com's hosted, read-only MCP server (23 tools, no API key or account). It's also listed in Anthropic's Claude directory and as a ChatGPT app.

Install: codex plugin marketplace add salemalem/npmscan-mcp-plugin, then codex plugin add npmscan@npmscan (tested with codex-cli 0.164.0).

Local scan with plugin-scanner 3.57.0 (hash checked against CONTRIBUTING):

• Without the Cisco extra: 100/100, no findings.
• With plugin-scanner[cisco]: 97/100, 0 critical, 2 high. Both are in skills/dependency-audit/references/test-prompts.md, the skill's manual test cases:
  • PROMPT_INJECTION_IGNORE_INSTRUCTIONS (line 400): test case 35 is a deliberately hostile package.json whose description says "ignore previous instructions". The test checks that the skill ignores it and warns the user.
  • UNICODE_OBFUSCATED_INSTRUCTION: the same file spells lоdash with a Cyrillic "о" on purpose to test typosquat detection, and it uses em dashes.

.plugin-scanner.toml disables one Kimi rule that misreads kimi.plugin.json, reported in hashgraph-online/hol-guard#6032. It doesn't affect the Codex manifest.

Checklist: .codex-plugin/plugin.json with composerIcon (PNG, 25 KB), SECURITY.md, MIT LICENSE, README, no secrets, no local MCP commands (remote HTTP only), no GitHub Actions.

[qodo-free-for-open-source-projects]

PR Summary by Qodo

List NPMScan in Tools & Integrations

📝 Documentation 🕐 Less than 5 minutes

AI Description

• Add NPMScan to the community plugin directory for pre-install npm package security checks.
• Describe its read-only, no-key MCP server and link to the plugin repository.

High-Level Assessment

A direct entry in the existing alphabetical community-plugin list is appropriate. The PR does not add an integration to this repository, so a separate component or configuration change is unnecessary.

Files changed (1) +1 / -0

Documentation (1) +1 / -0

README.mdAdd NPMScan to the community plugin directory +1/-0

Add NPMScan to the community plugin directory

• Adds a link to the NPMScan plugin between NotFair Plugin and Nullcost. The entry describes pre-install npm security checks and its free, read-only MCP server with 23 tools and no API key.

README.md

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. NPMScan breaks the catalog's alphabetical order 🐞 Bug ⚙ Maintainability

Description

The new README entry places NPMScan after NotFair Plugin, although NPMScan sorts before
NotFair by display name. This leaves the Tools & Integrations list out of order and violates the
catalog contribution requirement.

Code

README.md[437]

+- [NPMScan](https://github.com/salemalem/npmscan-mcp-plugin) - Check npm packages for malware, known vulnerabilities, typosquats and maintainer takeovers before installing, via npmscan.com's free, read-only MCP server (23 tools, no API key).

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new `NPMScan` entry is placed after `NotFair Plugin`, but the Tools & Integrations catalog must remain alphabetically sorted by display name.
## Fix Focus Areas
- README.md[435-438]
- CONTRIBUTING.md[105-105]
## Recommended Fix
Move the `NPMScan` line before the `NotFair Plugin` line so the surrounding entries are alphabetically ordered.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can type 'qodo, fix this' on a finding and the fix lands right on your PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[salemalem]

On the Qodo note about order: scripts/check-alphabetical.py compares lower-cased display names, so "notfair plugin" < "npmscan" < "nullcost". Moving NPMScan above NotFair would make that check fail. The bot appears to compare case-sensitively ("NP" < "No").

[kantorcodes]

Nonapproving review at 83df114db52a22d0fa80c48aa35d0dfffe7aefb2: I checked this one-line README change against scripts/check-alphabetical.py. The script lowercases entry names before comparison, so notfair plugin < npmscan < nullcost. The submitted placement is correct; the Qodo case-sensitive sorting suggestion should not be applied. The source repo's MIT license also matches the declared license. I cannot verify the catalog-owned scanner or contribution checks as passed: the workflow runs currently report action_required. Keeping this open for the required original catalog scan and independent technical/security review. No merge or publication approval.

[salemalem]

@kantorcodes thanks for the feedback

[kantorcodes]

Checks green, review threads resolved, quiet window elapsed at 83df114.

[internet-dot]

Checks green, review threads resolved, quiet window elapsed at 83df114.

[github-actions]

🎉 Congrats @salemalem, your plugin has been merged into the catalog! [Claim your plugin `salemalem/npmscan-mcp-plugin`](https://hol.org/guard/plugins?claim=salemalem%2Fnpmscan-mcp-plugin&utm_source=github&utm_medium=pr_comment&utm_campaign=plugin_claim&utm_content=merge_notice). Choose **"Continue with GitHub"** using the account that maintains the repository to verify ownership, view its trust score, and track installs and engagement. If you have already claimed it, the same link opens your plugin dashboard.