# Check a manifest or lockfile for compromised packages

> DependencyWatch.io scans a dependency manifest against 217 tracked supply-chain incidents. Pick the page for the file you have; each explains exactly what is parsed and how confident a match is. Scanning runs in the visitor's browser and the file is never uploaded, so there is no upload API. Agents that want to check versions programmatically should use the JSON export at https://dependencywatch.io/api/v1/packages.

- [package-lock.json](https://dependencywatch.io/check/package-lock-json.md) - npm, npm registry · exact-version lockfile · 165 tracked incidents
- [package.json](https://dependencywatch.io/check/package-json.md) - npm, npm registry · version-range manifest · 165 tracked incidents
- [yarn.lock](https://dependencywatch.io/check/yarn-lock.md) - Yarn, npm registry · exact-version lockfile · 165 tracked incidents
- [pnpm-lock.yaml](https://dependencywatch.io/check/pnpm-lock-yaml.md) - pnpm, npm registry · exact-version lockfile · 165 tracked incidents
- [requirements.txt](https://dependencywatch.io/check/requirements-txt.md) - pip, PyPI registry · exact-version lockfile · 84 tracked incidents

---

Canonical page: https://dependencywatch.io/check
Markdown version: https://dependencywatch.io/check.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).