Paste a package-lock.json, pnpm-lock.yaml, yarn.lock or requirements.txt. In seconds you will know whether you installed a package from one of 250 tracked supply-chain compromises.
Parsed locally in your browser. Nothing leaves your device, no logging, no network round-trip.
The scanner is a static page. Your lockfile is parsed and matched in the browser tab, so the answer arrives before anything could be sent anywhere.
package-lock.json, pnpm-lock.yaml, yarn.lock, package.json or requirements.txt. Nothing to install.
Every exact name and version is checked against every compromised release we track, inside your browser.
Each hit links to the incident write-up: what the malware does, when it was live and how to clean up.
New compromises are added as they are disclosed, each with affected versions, what the malware does and how to clean up. See all 250 →
On 9 November 2026 a malicious @ethersphere/bee-js 13.3.0 was published to npm via a compromised release identity. The version contains a postinstall hook that downloads and executes remote code, stealing Swarm node keys and installing a persistent remote shell.
OpenSSF and GitHub flagged pystr-codec 0.1.0, 0.1.1 and 0.1.2 on PyPI (GHSA-f93h-mc69-274w / MAL-2026-18432) as a Miasma-family credential-stealing worm, the first PyPI variant of the family seen on npm since June 2026. Any host that installed it should be treated as fully compromised.
On 2026-10-21 JFrog and Aikido disclosed that litellm 1.107.0 on PyPI ships an infostealer and a remote-access trojan in all 7 compiled wheels. A cook.pth file triggers the stealer at every Python interpreter start, harvesting credentials across cloud providers, CI/CD, browsers, AI tools, and package registries, while a sitecustomize.py hourly RAT loop fetches remote code from a GitHub dead-drop.
Each checker explains what it reads from that format and how confident the answer is.
Plain-English answers to the questions people ask after a compromise makes the news.
The same UK team that runs this feed runs CREST-accredited penetration tests, a 24/7 SOC and a live threat-intelligence practice. If you want the signal from this scanner feeding your defences directly, talk to us.
Talk to Precursor →Follow the incident feed, or subscribe in any feed reader to hear about the next one as soon as it is in the database.
A small amount of analytics helps us understand how the scanner gets used so we can make it better. Your lockfile scanning still runs entirely in your browser. We never sell or share your data. See our Privacy Policy for details.
You can change your choice later by clearing site data for dependencywatch.io.