<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting Dependency Hijacking — API Reference

## Socket CLI

```bash
# Scan package for supply chain risks
socket npm audit --json

# Check specific package
npx @socketsecurity/cli report create package-lock.json --json

# List known malicious packages
socket issues list --ecosystem npm --json
```

## pip-audit

```bash
# Audit installed packages
pip-audit --format json --output audit.json

# Audit from requirements file
pip-audit -r requirements.txt --format json

# Audit with OSV database
pip-audit --vulnerability-service osv --format json
```

## npm audit

```bash
# Full audit with JSON output
npm audit --json

# Audit production dependencies only
npm audit --omit=dev --json

# Fix automatically where possible
npm audit fix --dry-run --json
```

## Registry Verification

```bash
# Verify npm package integrity
npm pack package-name --dry-run 2>&1

# Check PyPI package hashes
pip hash download package-name==1.0.0
pip install --require-hashes -r requirements.txt

# Verify Go module checksums
go mod verify
```

