dependency-audit

对项目依赖进行漏洞与恶意包审计，管理锁定版本与供应链风险。

负责把项目依赖链里的漏洞和恶意包挑出来：在 CI 或开发阶段做漏洞扫描、恶意包名比对和供应链风险评估，并强制使用锁文件固定版本（如 package-lock、poetry.lock、go.sum）。当你新增依赖、升级库或做发布时用，能减少被后门或零日漏洞波及的可能。特色是把锁定版本、知名度/下载量和恶意包清单结合起来做多重把关。

# Dependency Audit

## Rules (for AI agents)

### ALWAYS
- Pin dependencies to exact versions in lockfiles (`package-lock.json`, `yarn.lock`,
  `Pipfile.lock`, `poetry.lock`, `go.sum`, `Cargo.lock`).
- Cross-check every new dependency name against the bundled malicious-package list in
  `vulnerabilities/supply-chain/malicious-packages/`.
- Prefer well-established packages with high download counts, multiple maintainers, and
  recent activity over newer alternatives that solve the same problem.
- Run the package manager's audit command (`npm audit`, `pip-audit`, `cargo audit`,
  `govulncheck`) and review reported issues before merging.
- Verify the package's repository URL on the package page