# Check package.json for compromised dependencies

> Paste your package.json to see whether any declared dependency range can resolve to a known-compromised npm version. Free, runs in your browser, no signup.

- File: package.json
- Package manager: npm
- Registry: npm
- Match precision: version ranges (manifest)
- Coverage: 165 tracked incidents, 4521 flagged packages on npm
- Scanner: https://dependencywatch.io/check/package-json (runs in the browser; the file is never uploaded)

package.json declares version ranges rather than exact versions, so it answers a slightly different question: not "was I compromised" but "could this range have resolved to a compromised version". It is the right file to check when you do not have a lockfile to hand.

## What we read from this file

- `dependencies`, `devDependencies`, `peerDependencies`, and `optionalDependencies`
- semver ranges - caret, tilde, comparators, and exact pins
- we skip npm aliases (`npm:other@^1`), plus git, file, link, and http dependencies, because they have no resolvable registry version

## How confident is a match?

Ranges give probable exposure, not confirmed exposure. We flag a dependency when a known-compromised version satisfies your declared range - whether you actually installed it depends on when you last resolved. Check your package-lock.json to confirm.

## devDependencies matter as much as dependencies

A malicious devDependency runs on every developer machine and every CI job that installs it. It does not need to reach production to steal your npm token or your cloud credentials, so we scan all four dependency blocks rather than just runtime ones.

## A caret range is wider than most people expect

`^1.2.3` accepts every 1.x release above 1.2.3, including one published five minutes ago by an attacker who just took over the maintainer account. That is precisely how several of the incidents in our database reached victims who had not changed a line of code.

## Frequently asked questions

### Why does package.json give a weaker answer than a lockfile?

Because it records intent, not outcome. `^1.2.3` describes a set of acceptable versions; only the lockfile records which one npm actually picked. We report range overlaps at a reduced confidence for exactly this reason - it tells you where to look, and the lockfile confirms it.

### I do not have a lockfile. Is checking package.json still worth it?

Yes, and it is a good reason to start committing one. Without a lockfile, every fresh `npm install` re-resolves your ranges against whatever is on the registry that day, so your exposure changes over time even with no code change. Checking package.json shows you which ranges are currently capable of resolving to something known-bad.

### Should I pin every dependency to an exact version?

Committing a lockfile is the more practical answer - it gives you reproducible installs without losing the ability to take patch updates deliberately. Pinning exact versions in package.json across a large tree tends to freeze transitive dependencies you never see, which is where most compromises actually live.

## Recent npm incidents

The most recent of 165 tracked incidents affecting this ecosystem. Full feed: https://dependencywatch.io/feed

- 2026-10-13 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-13 (**Baileys/libsignal lure operator wave 3** - 60+ npm packages across `@revizahoshii/*`, `@fazzcodestudio/*`, `@sanzoffc/*`, `@wanzlonely/*`, `@mikudeveloper/*`, `@modss/*`, `@ikanngeming/*`, `@fhkryxv/*`, `@saazkira/*`, `@badzz88/*`, `@alipclutch/*`, `@mivesensei/*`, `@kanaraa/*`, `@chatunity/*`, `@zanta/*`, `@yudzxml/*`, `@zeronexcode/*`, plus `baileys-xbats`/`bailslonely`/`nakkinpm`/`amprem` unscoped - all CWE-506 boilerplate takedowns against `@WhiskeySockets/Baileys` WhatsApp-automation lures; **confirmed-payload carve-outs within the sweep**: PyPI `npp-ml` Notepad++ impersonator deploying ADExplorer AD-recon tool, PyPI `minecraftaccfinder` Gmail/Roblox/Discord/Minecraft infostealer+RAT with keylogger/screenshots/browser-creds, RubyGems `wallet-balance-scanner` fake-native-extension reverse-shell to hardcoded endpoint; **s4yhii wave 3 continuation** `@s4yhiitestpoc/r2-https-b` on `collector.oob.s4yhii.com`; plus 25+ dep-confusion probes at `99.x`/`100.x`/`101.x` sentinels: `@myorder-frontend-commons/*`, `risk-detection`, `unified-platform`, `@pinecone-experience/*`, `@airbnb-extended/*`, `@tesla-insurance/*`, `@user-services/*`, `app-sca-info-banking`, `com.apple.unityplugin.storekit` Apple-brand impersonator, and more)](https://dependencywatch.io/incident/multi-2026-10-13-ghsa-malware-sweep)
- 2026-10-12 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-12 (**s4yhii operator wave 3**: 8 npm packages across `@s4yhiitestpoc/*` + `@coopeuch/*` Coopeuch-brand dep-confusion all beaconing `collector.oob.s4yhii.com/_npm-poc/beacon`; **`185.158.107.175:8787/_ah/dc` operator wave 2**: 6 npm `beacon.cjs`-pattern recon packages (`nitro-cjs-requirer`, `nitro-bundled-dep`, `nested-lib`, `cloudflare_module`, `another-very-long-name`, `some-very-long-package-name`); **`64.181.165.115/dc` native-addon operator**: 4 npm packages with HTTP/1.0 raw-socket beacons (`ksp-app`, `ksp-client-registry`, `pay-methods-kmf`, `deposit-limit-fe`); `liferay-workspace-scripts` bundled-dep from `ltidi.storage.googleapis.com/depenconf/`; `react-dropzone-v4`/`react-paginate-v5`/`kmf-vendor-pack`/`exodus-firestore-synchronize` dep-confusion probes; `hardhat-option@2.0.1` npm `hardhat-promised`-family stealer; `css-nesting-transform@1.0.0` Wix-brand `webhook.site` recon; PyPI `ig-gox` (`goxtools.shop` encrypted-loader) + `py2ops` trojaned-REPL. Big RubyGems wgkit wave-2 crypto cluster split out to its own carve-out.)](https://dependencywatch.io/incident/multi-2026-10-12-ghsa-malware-sweep)
- 2026-10-12 · [high, malicious package] [npm `hridoy-ultimate@8.0.0` ships Facebook email + password + TOTP 2FA secrets to `minhdong.site/api/v1/facebook/login_ios` and pins its `fca-unofficial` dep at `VangBanLaNhat/fca-unofficial#HEAD`](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer)
- 2026-10-11 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-11 (new `webreader` + `pafer` PyPI two-package pickle-execution RAT with disclosed `frjmzbjbhwvtdnsuodmu.supabase.co` + `api.npoint.io/40e32d283a9d97e59252/a` C2 and `.pth` persistence, where the main package hides the pickle and the mandatory dependency unpickles it; new `agentaix` PyPI 3-package first-publish RAT cluster (`agentaix`, `agent-vx`, `media-manager5`) with autorun persistence beaconing `googleforum.pythonanywhere.com`; and standalone `@library-wide/library-shell@99.9.1` npm dep-confusion sentinel flagged by OpenSSF Package Analysis for malicious-domain egress)](https://dependencywatch.io/incident/multi-2026-10-11-ghsa-malware-sweep)
- 2026-10-10 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-10 (new `s4yhii` native-binary credential-stealer dep-confusion operator - 16 npm packages across `@galicia-toolkit-nestjs/*`, `@galicia-toolkit-nestjs-20/*`, `@galicia-toolkit-nestjs-20-lite/*`, `@galicia-toolkit-cheques-nc/*`, `@brick-v2/*` loading prebuilds/-/metrics.node ELF+PE that forks+setsid and exfils AWS/GitHub/npm/Azure DevOps/Actions tokens to oob.s4yhii.com/native; `@tunstock/remact-dom@19.2.0` react-dom typosquat with confirmed `tele.metry.orgin.net/api/v1/events` beacon; Baileys/libsignal lure continuation `@fer2809fl/baileys`+`cloud-baileys`+`arsya-baileys`+10-package `asepxyz*` cluster; crates.io `sharpnes` Telegram-Desktop + Chrome-extension/wallet infostealer (first cargo malware advisory this week); 3-package `kmf-*` + 2-package internal-frontend dep-confusion with oast.pro OAST; 5-package `@tvg-mar/*` dep-confusion probes; 2 Tailwind typosquats; plus pypi `ig-gox` Instagram abuse)](https://dependencywatch.io/incident/multi-2026-10-10-ghsa-malware-sweep)
- 2026-10-09 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-09 (xwise8887 wave-2 continuation `wie888r`/`testrrrd`/`xblaxw`/`@wxwxtest/testrrrdd` to `185.158.107.175:8787/_ah/dc`; Wix dep-confusion cluster `wix-reg-poc-bypass` (webhook.site) + `css-overscroll-contain` (dxpoc.gt.tc, K8s SA-token theft + container escape); `pxnpm` nfjbill-operator npm proxy weaponization (same operator as 2026-08 `yakuza0`); 16-package `@bellaxchuu/*` + sibling Baileys-themed lure cluster; 6-package `@dransay/*` oast.site dep-confusion probes; `@bitwardne/*` 2-package Bitwarden typosquat; 5-package `@galicia-toolkit/*`+`@design-system-coopeuch/web` dep-confusion cluster; 9 dev-tooling typosquats; 2 pypi `kafka-roller`/`kafka-helmsman` 99.x dep-confusion probes; plus standalones)](https://dependencywatch.io/incident/multi-2026-10-09-ghsa-malware-sweep)
- 2026-10-08 · [critical, compromise] [`tensorlake` npm maintainer-account compromise - malicious `0.5.144` published one patch above the real `0.5.143` latest and quarantined by npm security](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)
- 2026-10-08 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-08 (named compromise carve-out: `tensorlake@0.5.144` maintainer-account compromise; plus npm `internallib_v788` wave-3 continuation of the `internallib_v<N>` RFC1918 reverse-shell operator; new npm `troubleshooting`/`browser-metrics-plugin.contrib` dep-confusion probe from `xwise8887` with HTTP beacon to `185.158.107.175:8787`; new npm `personio-pipeline-projen` dep-confusion probe from `reaperhackbot256f` with `oast.fun`+`oastify.com` DNS/HTTPS exfil; new npm `imgbundle`+`cdn-img-fetch` img-themed sleeper cluster from `malfexteste2`; npm `function-color@1.7.3`+`function-flag@1.7.3` 2025-08-04 backfilled low-version sideload sleepers caught today; 3-package npm `@ikyyjee/ikkysingle`/`ikyysingle`/`ikyysinggle` typosquat burst; 2 Amazon-Inspector namespace-holder takedowns `windows_registry_editor`/`store-webpack-config`; and 5 CWE-506 boilerplate takedowns)](https://dependencywatch.io/incident/multi-2026-10-08-ghsa-malware-sweep)

## Other manifest formats

- package-lock.json (npm): https://dependencywatch.io/check/package-lock-json
- yarn.lock (Yarn): https://dependencywatch.io/check/yarn-lock
- pnpm-lock.yaml (pnpm): https://dependencywatch.io/check/pnpm-lock-yaml
- requirements.txt (pip): https://dependencywatch.io/check/requirements-txt

---

Canonical page: https://dependencywatch.io/check/package-json
Markdown version: https://dependencywatch.io/check/package-json.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).