infynon-pkg — Claude Code plugin: secure package installs
A skill and subagent that checks your dependencies for CVEs, intercepts installs across 14 package ecosystems and suggests safe versions.
/plugin marketplace add anthropics/claude-plugins-community
/plugin install infynon-pkg@claude-communityWhat infynon-pkg does
infynon-pkg belongs to the INFYNON suite for Claude. Once installed, the agent spots lock files in your project and offers a vulnerability scan backed by OSV.dev. Three skills ship with it: package-security fires on CVE and dependency-audit questions, cve-triage helps you read scan output and rank fixes, and eagle-eye-monitor handles ongoing monitoring with email alerts. A pkg-guardian subagent covers deeper analysis, migration advice and CI setup.
Everything runs on the infynon CLI. Without it, the skills can only tell you what to install. The CLI itself comes from npm install -g infynon, a shell script on Linux and macOS, or a Rust build from source. Installs go through a wrapper: infynon pkg npm install express, infynon pkg uv add fastapi, infynon pkg cargo add serde. For CI there are --strict high (exits with code 3), --json, --auto-fix, --skip-vulnerable and --no-input.
The plugin wraps your package manager rather than replacing it, so commands still land in npm, pip or cargo. Session hooks from the sibling infynon-trace plugin are opt-in and written to the project's .claude/settings.json, never to system-level settings.
What it helps with
- scan a project's dependencies for known CVEs
- install a package without pulling in a vulnerable version
- make sense of scan results and pick what to fix first
- set up non-interactive auditing in CI
- find out why a package sits in the dependency tree
Example prompts for the agent
- Scan this project's dependencies for vulnerabilities and flag the critical ones
- Install express safely, checking versions first
- Set up vulnerability monitoring with email alerts
How to install infynon-pkg
Plugin marketplace
/plugin marketplace add anthropics/claude-plugins-community/plugin install infynon-pkg@claude-communityStep by step, with commands for each platform: Claude Code plugins: marketplaces, installing, and building your own
Questions about infynon-pkg
How do I install infynon-pkg in Claude Code?
Add the marketplace first: /plugin marketplace add anthropics/claude-plugins-community, then install the plugin: /plugin install infynon-pkg@claude-community.
What does infynon-pkg do?
It intercepts package install commands, scans lock files for CVEs through OSV.dev and suggests safe versions. Dependency auditing and continuous monitoring come with it.
Which package ecosystems does it cover?
14 managers: npm, yarn, pnpm, bun, pip, uv, poetry, cargo, go, gem, composer, nuget, hex and pub.
