All projects matching “codes”

Safely follow bounded public HTTP redirects and compare the final URL with the expected target; return a deterministic verdict and reason code.

Typosquat and quality signals for an npm package before installing it: weekly downloads, latest version, license, deprecation notice, repository link, and computed risk flags (low_downloads, deprecated, no_repository, no_license, not_found). A package with 12 weekly downloads pretending to be a popular library is the classic supply-chain attack on coding agents. Pairs with the package-vulns endpoi