opm check
Scans all dependencies for typosquats, CVEs, on-chain risk, and AI-detected threats. Optionally uploads a report to Fileverse.What It Scans
- Typosquats — Levenshtein distance against top npm packages
- CVEs — OSV API lookup for known vulnerabilities per package/version
- On-chain scores — Aggregate risk from OPMRegistry for registered packages
- AI analysis — 3 agents analyze the full dependency list in parallel, producing severity ratings and suggested replacements
Output
- Per-dependency results: typosquats, CVE counts, on-chain scores, fix versions
- AI agent findings with severity and suggested replacements
- Summary: total typosquats, CVEs, high-risk, AI flags
- Fileverse report link when upload succeeds
Requires
OPENROUTER_API_KEY or OPENAI_API_KEY for AI analysis. Without them, typosquat and CVE checks still run.