ci: flag risky dependency changes on PRs with npmscan (warn-only)

[salemalem]

Disclosure: I'm the creator of npmscan.com and maintain NPMscan/npmscan-action, so I have a direct interest in this being adopted. This PR was written with AI assistance (Claude Code, Claude Opus 5.5).

Related to #429, which asks for scanning that blocks malicious packages before they reach the code. This is one lightweight option for the "or similar": it reviews each dependency PR rather than installing a GitHub app.

What it does

Adds .github/workflows/npmscan.yml. When a PR changes a package.json or package-lock.json, it diffs the lockfile against the base commit and reports only what changed:

• Known malware and vulnerabilities on newly added or changed versions (OSV.dev and GitHub Advisories)
• New install scripts: a dependency that gains preinstall/install/postinstall, or a new dependency that has one
• Repointed lockfile entries: the same version with a different tarball URL or integrity hash, or a tarball that's actually a different package

How it's configured

• mode: warn and fail-on-error: false: it never fails the check, even if the npmscan API is down.
• The npmscan action is pinned to its full v1.3.0 SHA, and checkout uses the same v7.0.1 SHA as your other workflows, with persist-credentials: false. Workflow-level contents: read; the job adds pull-requests: write, used only to post or update one report comment. Fork PRs get a read-only token, so their report goes to the job summary instead.
• No API key or secrets. The only data it sends is package-lock.json, from the base commit and from the PR, over HTTPS to the npmscan.com API; nothing is stored (privacy). It's a composite action, one bash script plus a jq template (source, de14168 is the v1.3.0 tag).

Testing

The workflow only runs on a PR that changes a package.json or the lockfile, so it doesn't run on this one. I replayed #287's lockfile change (openai 6 → 7) through the same API: it parses and flags nothing.

[trailhq-graft]

🌱 graft blast radius

Nothing outside this diff depends on it. 0 areas changed; no indexed dependents at depth 2.

⚠️ 1 changed file not in the graph (.github/workflows/npmscan.yml) — no parser claims the extension, or the index predates the file.

_{graft blast · origin/main...HEAD · depth 2 · 1 changed file}

Open the interactive graph → — click an area to see its dependent symbols at file:line.