npm · supply-chain security

Defending your dependencies
before they turn on you.

Paste or upload a package.json. Checks every direct dependency for typosquatting, malicious install scripts, and maintainer/version anomalies against live npm registry data.

Start scanning

Scroll to scan

Run a scan

Paste your `package.json`

package.json contents

📄 Upload file

High means 2+ independent signal types landed on the same package — not "likely malicious." Treat every score as worth a closer look, not a verdict.

Package	Version Range	Type	Score	Signals

Defending your dependencies before they turn on you.

Paste your package.json

Defending your dependencies
before they turn on you.

Paste your `package.json`