skills.rest
nodesource
nodesourceOFFICIAL
Explore all skills by this author →
Website𝕏@NodeSourceGitHub

ns-replace-package

Finds and evaluates npm package alternatives using NCM vulnerability and quality data.

6|7|Updated Jun 4, 2026
Search Tags:#npm#node.js#vulnerability analysis#ncm#api migration#package migration#dependency replacement
One-click install
npx skills add https://github.com/nodesource/nsolid-plugin --skill ns-replace-package-nodesource
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ns-replace-package
Source: https://github.com/nodesource/nsolid-plugin/tree/main/skills/ns-replace-package
Command: npx skills add https://github.com/nodesource/nsolid-plugin --skill ns-replace-package-nodesource

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Replacing a deprecated, abandoned, or risky npm dependency requires researching alternatives, checking their security posture, and planning the migration. This Skill automates that evaluation by grounding every recommendation in NCM vulnerability, license, and module-risk data. ## Core Features & Use Cases - NCM-Grounded Evaluation: Fetches vulnerability, license, and module-risk data for the package being replaced and for every proposed alternative before recommending it. - Comparison and Ranking: Produces a comparison table covering vulnerabilities, licenses, module risks, and maintenance signals, leading with the strongest recommendation. - Migration Plan: Delivers install/uninstall commands for the detected package manager, API before/after code examples, configuration changes, and a post-migration test checklist. - Use Case: A team discovers their HTTP library is unmaintained and flagged by NCM. The Skill proposes two vetted alternatives, compares their security posture, and generates a step-by-step migration plan with code diffs. ## Quick Start Ask the assistant to find a safer replacement for a specific dependency in your package.json and generate a migration plan.

Frequently Asked Questions about ns-replace-package

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I replace an npm package with a safer alternative?▼

Identify the package to replace, then evaluate 2-3 realistic alternatives using NCM vulnerability, license, and module-risk data. The Skill compares candidates in a ranked table and generates a migration plan with install commands and API code examples.

How to check if an npm package alternative has vulnerabilities?▼

Call the NCM getPackageQuality tool for each candidate package before recommending it. It returns vulnerability severity and titles, license information, and module risks such as install scripts or obfuscation.

Does it support pnpm and yarn when replacing dependencies?▼

Yes, the package manager is detected from the lockfile: pnpm-lock.yaml maps to pnpm, yarn.lock to yarn, and package-lock.json to npm, defaulting to npm. Install and uninstall commands are generated for the detected manager.

What happens if NCM data is unavailable for a package?▼

The Skill states clearly that NCM data is unavailable and proceeds with general guidance only, explicitly flagging the absence of grounded security data rather than fabricating findings.

When should I use package replacement instead of upgrading?▼

Use replacement when the package is deprecated, abandoned, or carries critical risks that upgrades cannot fix. For staying on the same package and moving to a newer version, use the ns-upgrade-package skill instead.

Related Skills

Explore More Software Engineering Skills→
mitchellvandusen-cellmitchellvandusen-cell

dependency-audit

Audit Python dependencies for CVEs, outdated packages, licenses, and unused imports.

Community
Advanced
onesmartguyonesmartguy

planning-deprecated

Provides migration steps and command mapping for transitioning to aidlc from legacy planning plugin.

Community
Basic
TanStackTanStack
15.0k

bundle-size-optimization

Measures and reduces JavaScript bundle gzip size using Nx benchmarks and Rolldown analysis.

Official
Advanced
getsentrygetsentry
8.7k

upgrade-dep

Upgrade dependencies in the Sentry JavaScript SDK monorepo with yarn.

Official
Intermediate