A CLI tool that scans a project dependency tree for npm v12 breaking-change exposure and outputs a prioritized migration plan

npm v12 ships in July 2026 and makes three previously implicit behaviors opt-in: lifecycle install scripts from dependencies, git-sourced packages, and remote-URL packages. A project can have hundreds of transitive dependencies and no quick way to know which ones will break at upgrade time. This CLI walks the full lockfile, classifies every dependency by its exposure type, checks whether each package has a binding.gyp or explicit install-script hook, flags git and remote-URL entries, and produces a prioritized allowlist-ready migration report with per-package risk scores and one-command fixes. It is not a general vulnerability scanner and not a dependency version updater; it is specifically scoped to the v12 breaking-change surface and outputs a commit-ready package.json allowScripts block plus CI patch instructions.