# DependencyWatch.io guides

> Explanatory guides on software supply-chain attacks: why audit tools miss malicious packages, what to do after installing one, and how the checker here differs from advisory-based scanners.

- [Does npm audit detect malicious packages?](https://dependencywatch.io/guides/does-npm-audit-detect-malware.md) - npm audit finds known vulnerabilities in legitimate packages. It is much weaker at finding deliberately malicious ones, and this explains why - plus what to run instead. (updated 2026-08-03)
- [You installed a malicious package. What now?](https://dependencywatch.io/guides/what-to-do-after-installing-a-malicious-package.md) - A practical incident-response order of operations for developers who have just found a compromised package in their dependency tree - what to rotate, in what order, and what not to bother with. (updated 2026-08-03)
- [How to tell if an npm package is malicious](https://dependencywatch.io/guides/how-to-tell-if-an-npm-package-is-malicious.md) - Practical signals for judging whether an npm package is safe to install - what actually predicts trouble, what looks alarming but does not, and how to check before you install. (updated 2026-08-03)
- [Lockfile security: what actually helps](https://dependencywatch.io/guides/lockfile-security-best-practices.md) - Why committing a lockfile matters for supply-chain security, how npm ci differs from npm install, and the lockfile habits that reduce real exposure. (updated 2026-08-03)
- [The main types of dependency supply-chain attack](https://dependencywatch.io/guides/types-of-supply-chain-attacks.md) - Typosquatting, dependency confusion, maintainer account takeover, and self-propagating worms - how each one reaches you and which defences actually apply to which. (updated 2026-08-03)

---

Canonical page: https://dependencywatch.io/guides
Markdown version: https://dependencywatch.io/guides.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).