[salemalem]

What does this PR do?

Adds a standalone .github/workflows/npmscan.yml that runs npmscan-action on pull requests. It diffs the lockfile between the PR base and head and flags supply-chain red flags in the changed dependencies: newly added install scripts (preinstall/install/postinstall), repointed or swapped tarballs (URL/integrity changes), added or changed overrides/resolutions, and known vulnerabilities in newly introduced versions.

Why?

Malicious package versions usually arrive through lockfile changes in otherwise ordinary PRs, where a reviewer rarely reads the lockfile diff. This check summarises what changed so those entries stand out.

Configuration notes

• Non-blocking: mode: warn and fail-on-error: false, so it reports findings but never fails CI.
• Pinned: the action is pinned to a full commit SHA, not a floating tag.
• Scoped: one new file; no existing workflows are touched. The job only needs contents: read (plus pull-requests: write to post a single summary comment; on fork PRs the token is read-only, so findings go to annotations and the job summary instead).

Disclosure

I maintain npmscan and npmscan-action, so I have an interest in this. If it isn't a fit for the project, please feel free to close; no hard feelings.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T18:54:27.709859Z	d3ae610	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d3ae610b8b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin the checkout action to a full commit SHA

actions/checkout@v4 is a mutable reference, unlike the full commit SHAs used in the existing pull-request workflow. A routine retag or compromise would therefore run unreviewed checkout code on every PR with this workflow's pull-requests: write token, allowing that code to alter PRs; pin checkout to a reviewed commit SHA so this supply-chain check does not itself add a mutable CI dependency.

Useful? React with 👍 / 👎.