dep-audit

Audit dependency-manifest / lockfile changes in a diff. A zero-network offline pass scores the diff (semver deltas, pin loosening, lockfile-integrity changes, install scripts, typosquatting); then per-ecosystem scanner agents run the real tools (osv-scanner, npm audit, pip-audit, cargo audit, govulncheck) and maintainer-health checks.