diff --git a/.github/workflows/npmscan.yml b/.github/workflows/npmscan.yml
new file mode 100644
index 000000000..4cdf92fd2
--- /dev/null
+++ b/.github/workflows/npmscan.yml
@@ -0,0 +1,30 @@
+name: NPMscan
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths: [package.json, pnpm-lock.yaml, .github/workflows/npmscan.yml]
+
+permissions: {}
+
+jobs:
+  npmscan:
+    name: Dependency Security Scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - name: Run NPMscan
+        uses: NPMscan/npmscan-action@83cb7d67204f8f2d1f76454ee9abf19c480dec26 # v1.4.0
+        with:
+          files: |
+            pnpm-lock.yaml
+            package.json
+          mode: warn
+          comment: on-findings
+          fail-on-error: false