Check a lockfile for compromised dependencies
Pick the file you have. Each checker explains exactly what it reads and how confident the answer is, then matches it against 5,378 compromised packages from 217 tracked incidents. Nothing is uploaded - the scan runs in your browser.
- package-lock.jsonnpmexact versions
package-lock.json is the highest-confidence file you can give us. It records the exact version npm installed for every direct and transitive dependency, so a match here is not a guess - it means the compromised version is pinned in your tree.
- package.jsonnpmversion ranges
package.json declares version ranges rather than exact versions, so it answers a slightly different question: not "was I compromised" but "could this range have resolved to a compromised version". It is the right file to check when you do not have a lockfile to hand.
- yarn.locknpmexact versions
yarn.lock records the exact version Yarn resolved for every dependency in your tree, so a match is confirmed rather than probable. We read both Yarn Classic (v1) and Yarn Berry lockfiles.
- pnpm-lock.yamlnpmexact versions
pnpm-lock.yaml pins the exact version of every package in your store, including the full transitive graph, so it gives a confirmed answer. We support both the v6 and v9 lockfile layouts.
- requirements.txtPyPIexact versions
requirements.txt is the most common way Python projects declare dependencies, and how precise an answer we can give depends entirely on whether you pinned versions. Exact pins give a confirmed answer; unpinned entries give an advisory.
Incident database last updated . Using Poetry, Pipenv, or uv? Export to requirements.txt and use the requirements.txt checker.