Static npm supply-chain malware scanner — diffs new releases, YAML rules triage + LLM review, no execution - View it on GitHub