Add check-new-deps hook

[John-David Dalton (jdalton)]

Summary

Adds a Claude Code PreToolUse hook that checks new dependencies against the Socket.dev malware API before they're added to the project.

When Claude edits or writes a dependency manifest file, the hook:

• Extracts newly-added dependencies from the edit
• Sends them to sdk.checkMalware() as Package URLs (PURLs)
• Blocks the edit (exit 2) if malware is detected
• Allows the edit (exit 0) if clean or not a manifest file

Diff-aware: only checks deps added in the current edit, not pre-existing ones.

Files

• .claude/hooks/check-new-deps/index.mts — hook script
• .claude/hooks/check-new-deps/test/extract-deps.test.mts — unit + integration tests
• .claude/hooks/check-new-deps/package.json — deps (@socketsecurity/sdk, @socketsecurity/lib, @socketregistry/packageurl-js)
• .gitignore — updated to track .claude/hooks/

Supported manifest formats

npm, PyPI, Cargo, Go, Maven, RubyGems, NuGet, Composer

Setup

Add to .claude/settings.json:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "node .claude/hooks/check-new-deps/index.mts"
          }
        ]
      }
    ]
  }
}

Test plan

• cd .claude/hooks/check-new-deps && npm install && npm test
• Verify malware packages are blocked (bradleymeck test case)
• Verify clean packages pass through (lodash, express, etc.)
• Test with Claude Code by adding the hook to settings.json

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​node@​24.9.2
	npm/​@​socketregistry/​packageurl-js@​1.4.2
	npm/​@​socketsecurity/​lib@​5.18.0
	npm/​@​socketsecurity/​sdk@​4.0.0

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​node@​24.9.2
	npm/​@​socketregistry/​packageurl-js@​1.4.2
	npm/​@​socketsecurity/​lib@​5.18.0
	npm/​@​socketsecurity/​sdk@​4.0.0

View full report

[socket-security-staging]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report