pkgmd 0.1.0

Turn published npm, PyPI, and Go packages into clean Markdown for agent supply-chain review before install.

pkgmd

Turn published npm, PyPI, and Go packages into clean Markdown for agent supply-chain review before install.

Installation · Usage · Claude Code Skill · Ecosystems · pkgmd.com

---

What it does

Every package release is a black box until you open it. pkgmd downloads the published artifact, extracts it, and renders the full source tree as a single Markdown file your agent can read, review, and reason about — before the package ever touches your environment.

Recent supply-chain compromises on Axios, LiteLLM, and Trivy showed that even trusted packages can be compromised at the release level. This tool gives your agent the artifact, not just the metadata.

---

Installation

pipx install pkgmd

Or with pip:

pip install pkgmd

---

Usage

pkgmd ingest npm react
pkgmd ingest pypi requests==2.32.3
pkgmd ingest go rsc.io/quote@v1.5.2
pkgmd diff npm react 18.2.0 18.3.0

Leave version blank to resolve the latest published release. Output is written to a .md file in the current directory, or to stdout with -o -.

---

Claude Code Skill

Install the package-inspect skill to have Claude automatically inspect packages before installing them:

npx @anthropic-ai/claude-code add-skill arsolutioner/pkgmd

The skill teaches Claude to run pkgmd ingest before any npm install, pip install, go get, or equivalent command, and review the digest for signs of compromise.

---

Supported Ecosystems

Ecosystem	Spec format	Example
npm	name@version	react@18.2.0
PyPI	name==version	requests==2.32.3
Go	module@version	rsc.io/quote@v1.5.2

---

License

MIT