# Check package-lock.json for compromised packages

> Paste your package-lock.json and see instantly whether it pins a package version from a known npm supply-chain compromise. Free, no signup, runs entirely in your browser.

- File: package-lock.json
- Package manager: npm
- Registry: npm
- Match precision: exact versions (lockfile)
- Coverage: 165 tracked incidents, 4521 flagged packages on npm
- Scanner: https://dependencywatch.io/check/package-lock-json (runs in the browser; the file is never uploaded)

package-lock.json is the highest-confidence file you can give us. It records the exact version npm installed for every direct and transitive dependency, so a match here is not a guess - it means the compromised version is pinned in your tree.

## What we read from this file

- lockfileVersion 1, 2, and 3 - we detect which you have and read the matching structure
- the flat `packages` map in v2/v3, including nested `node_modules/a/node_modules/b` paths
- the recursive `dependencies` tree in v1
- transitive dependencies, not just your direct ones - most compromises arrive several levels deep

## How confident is a match?

Because a lockfile pins exact versions, every match is confirmed rather than probable. If we flag something, that specific build really did resolve to a version named in a public advisory.

## Transitive dependencies are the whole point

Almost nobody installs a malicious package directly. It arrives as a dependency of a dependency, which is exactly what a lockfile captures and package.json does not. We walk the full tree and tell you the path that pulled it in.

## lockfileVersion 2 contains both structures

npm 7+ writes a v2 lockfile with both the legacy `dependencies` tree and the modern `packages` map, for backwards compatibility. We read the `packages` map when present because it is the authoritative one, and fall back to the tree otherwise.

## Frequently asked questions

### Does npm audit already catch this?

`npm audit` checks your tree against the GitHub Advisory Database for *vulnerabilities* - bugs in legitimate packages. It is much weaker on *malware*: packages published deliberately to steal credentials. Those are usually removed from the registry within hours, and once the package is gone, `npm audit` frequently reports nothing at all even though the malicious version is still pinned in your lockfile and still sitting in your CI cache. That gap is what this tool covers.

### Is my lockfile uploaded anywhere?

No. The parsing and matching both run in your browser as JavaScript. Your lockfile is never sent to our servers, and there is no request containing its contents. You can confirm this by opening your browser devtools network tab while you run a scan.

### What should I do if it finds something?

Treat the host as compromised rather than just bumping the version. Most of these packages run code at install time, so by the time you notice, the payload has already executed with your environment variables in scope. Rotate credentials from a different machine, then pin to a safe version and clear your CI and private-registry caches - mirrors routinely keep serving tarballs after the public registry has pulled them.

### My package-lock.json is huge. Will it still work?

Yes. We handle files up to 12 MB, which comfortably covers monorepo lockfiles with tens of thousands of entries. Nothing is uploaded, so size only affects how long your own browser takes - usually well under a second.

## Recent npm incidents

The most recent of 165 tracked incidents affecting this ecosystem. Full feed: https://dependencywatch.io/feed

- 2026-10-13 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-13 (**Baileys/libsignal lure operator wave 3** - 60+ npm packages across `@revizahoshii/*`, `@fazzcodestudio/*`, `@sanzoffc/*`, `@wanzlonely/*`, `@mikudeveloper/*`, `@modss/*`, `@ikanngeming/*`, `@fhkryxv/*`, `@saazkira/*`, `@badzz88/*`, `@alipclutch/*`, `@mivesensei/*`, `@kanaraa/*`, `@chatunity/*`, `@zanta/*`, `@yudzxml/*`, `@zeronexcode/*`, plus `baileys-xbats`/`bailslonely`/`nakkinpm`/`amprem` unscoped - all CWE-506 boilerplate takedowns against `@WhiskeySockets/Baileys` WhatsApp-automation lures; **confirmed-payload carve-outs within the sweep**: PyPI `npp-ml` Notepad++ impersonator deploying ADExplorer AD-recon tool, PyPI `minecraftaccfinder` Gmail/Roblox/Discord/Minecraft infostealer+RAT with keylogger/screenshots/browser-creds, RubyGems `wallet-balance-scanner` fake-native-extension reverse-shell to hardcoded endpoint; **s4yhii wave 3 continuation** `@s4yhiitestpoc/r2-https-b` on `collector.oob.s4yhii.com`; plus 25+ dep-confusion probes at `99.x`/`100.x`/`101.x` sentinels: `@myorder-frontend-commons/*`, `risk-detection`, `unified-platform`, `@pinecone-experience/*`, `@airbnb-extended/*`, `@tesla-insurance/*`, `@user-services/*`, `app-sca-info-banking`, `com.apple.unityplugin.storekit` Apple-brand impersonator, and more)](https://dependencywatch.io/incident/multi-2026-10-13-ghsa-malware-sweep)
- 2026-10-12 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-12 (**s4yhii operator wave 3**: 8 npm packages across `@s4yhiitestpoc/*` + `@coopeuch/*` Coopeuch-brand dep-confusion all beaconing `collector.oob.s4yhii.com/_npm-poc/beacon`; **`185.158.107.175:8787/_ah/dc` operator wave 2**: 6 npm `beacon.cjs`-pattern recon packages (`nitro-cjs-requirer`, `nitro-bundled-dep`, `nested-lib`, `cloudflare_module`, `another-very-long-name`, `some-very-long-package-name`); **`64.181.165.115/dc` native-addon operator**: 4 npm packages with HTTP/1.0 raw-socket beacons (`ksp-app`, `ksp-client-registry`, `pay-methods-kmf`, `deposit-limit-fe`); `liferay-workspace-scripts` bundled-dep from `ltidi.storage.googleapis.com/depenconf/`; `react-dropzone-v4`/`react-paginate-v5`/`kmf-vendor-pack`/`exodus-firestore-synchronize` dep-confusion probes; `hardhat-option@2.0.1` npm `hardhat-promised`-family stealer; `css-nesting-transform@1.0.0` Wix-brand `webhook.site` recon; PyPI `ig-gox` (`goxtools.shop` encrypted-loader) + `py2ops` trojaned-REPL. Big RubyGems wgkit wave-2 crypto cluster split out to its own carve-out.)](https://dependencywatch.io/incident/multi-2026-10-12-ghsa-malware-sweep)
- 2026-10-12 · [high, malicious package] [npm `hridoy-ultimate@8.0.0` ships Facebook email + password + TOTP 2FA secrets to `minhdong.site/api/v1/facebook/login_ios` and pins its `fca-unofficial` dep at `VangBanLaNhat/fca-unofficial#HEAD`](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer)
- 2026-10-11 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-11 (new `webreader` + `pafer` PyPI two-package pickle-execution RAT with disclosed `frjmzbjbhwvtdnsuodmu.supabase.co` + `api.npoint.io/40e32d283a9d97e59252/a` C2 and `.pth` persistence, where the main package hides the pickle and the mandatory dependency unpickles it; new `agentaix` PyPI 3-package first-publish RAT cluster (`agentaix`, `agent-vx`, `media-manager5`) with autorun persistence beaconing `googleforum.pythonanywhere.com`; and standalone `@library-wide/library-shell@99.9.1` npm dep-confusion sentinel flagged by OpenSSF Package Analysis for malicious-domain egress)](https://dependencywatch.io/incident/multi-2026-10-11-ghsa-malware-sweep)
- 2026-10-10 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-10 (new `s4yhii` native-binary credential-stealer dep-confusion operator - 16 npm packages across `@galicia-toolkit-nestjs/*`, `@galicia-toolkit-nestjs-20/*`, `@galicia-toolkit-nestjs-20-lite/*`, `@galicia-toolkit-cheques-nc/*`, `@brick-v2/*` loading prebuilds/-/metrics.node ELF+PE that forks+setsid and exfils AWS/GitHub/npm/Azure DevOps/Actions tokens to oob.s4yhii.com/native; `@tunstock/remact-dom@19.2.0` react-dom typosquat with confirmed `tele.metry.orgin.net/api/v1/events` beacon; Baileys/libsignal lure continuation `@fer2809fl/baileys`+`cloud-baileys`+`arsya-baileys`+10-package `asepxyz*` cluster; crates.io `sharpnes` Telegram-Desktop + Chrome-extension/wallet infostealer (first cargo malware advisory this week); 3-package `kmf-*` + 2-package internal-frontend dep-confusion with oast.pro OAST; 5-package `@tvg-mar/*` dep-confusion probes; 2 Tailwind typosquats; plus pypi `ig-gox` Instagram abuse)](https://dependencywatch.io/incident/multi-2026-10-10-ghsa-malware-sweep)
- 2026-10-09 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-09 (xwise8887 wave-2 continuation `wie888r`/`testrrrd`/`xblaxw`/`@wxwxtest/testrrrdd` to `185.158.107.175:8787/_ah/dc`; Wix dep-confusion cluster `wix-reg-poc-bypass` (webhook.site) + `css-overscroll-contain` (dxpoc.gt.tc, K8s SA-token theft + container escape); `pxnpm` nfjbill-operator npm proxy weaponization (same operator as 2026-08 `yakuza0`); 16-package `@bellaxchuu/*` + sibling Baileys-themed lure cluster; 6-package `@dransay/*` oast.site dep-confusion probes; `@bitwardne/*` 2-package Bitwarden typosquat; 5-package `@galicia-toolkit/*`+`@design-system-coopeuch/web` dep-confusion cluster; 9 dev-tooling typosquats; 2 pypi `kafka-roller`/`kafka-helmsman` 99.x dep-confusion probes; plus standalones)](https://dependencywatch.io/incident/multi-2026-10-09-ghsa-malware-sweep)
- 2026-10-08 · [critical, compromise] [`tensorlake` npm maintainer-account compromise - malicious `0.5.144` published one patch above the real `0.5.143` latest and quarantined by npm security](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)
- 2026-10-08 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-08 (named compromise carve-out: `tensorlake@0.5.144` maintainer-account compromise; plus npm `internallib_v788` wave-3 continuation of the `internallib_v<N>` RFC1918 reverse-shell operator; new npm `troubleshooting`/`browser-metrics-plugin.contrib` dep-confusion probe from `xwise8887` with HTTP beacon to `185.158.107.175:8787`; new npm `personio-pipeline-projen` dep-confusion probe from `reaperhackbot256f` with `oast.fun`+`oastify.com` DNS/HTTPS exfil; new npm `imgbundle`+`cdn-img-fetch` img-themed sleeper cluster from `malfexteste2`; npm `function-color@1.7.3`+`function-flag@1.7.3` 2025-08-04 backfilled low-version sideload sleepers caught today; 3-package npm `@ikyyjee/ikkysingle`/`ikyysingle`/`ikyysinggle` typosquat burst; 2 Amazon-Inspector namespace-holder takedowns `windows_registry_editor`/`store-webpack-config`; and 5 CWE-506 boilerplate takedowns)](https://dependencywatch.io/incident/multi-2026-10-08-ghsa-malware-sweep)

## Other manifest formats

- package.json (npm): https://dependencywatch.io/check/package-json
- yarn.lock (Yarn): https://dependencywatch.io/check/yarn-lock
- pnpm-lock.yaml (pnpm): https://dependencywatch.io/check/pnpm-lock-yaml
- requirements.txt (pip): https://dependencywatch.io/check/requirements-txt

---

Canonical page: https://dependencywatch.io/check/package-lock-json
Markdown version: https://dependencywatch.io/check/package-lock-json.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).