Use when reviewing dependencies, lockfile diffs, CVE alerts, supply chain risk, SBOM generation, npm audit, pip-audit, dependabot or renovate PRs, version bumps, postinstall scripts, transitive packages, or package manifests like package.json, requirements.txt, Cargo.toml, go.sum, pom.xml, Gemfile.lock.
