# Check pnpm-lock.yaml for compromised packages > Paste your pnpm-lock.yaml and instantly check it against known npm supply-chain compromises. Supports lockfile v6 and v9. Free, runs in your browser. - File: pnpm-lock.yaml - Package manager: pnpm - Registry: npm - Match precision: exact versions (lockfile) - Coverage: 165 tracked incidents, 4521 flagged packages on npm - Scanner: https://dependencywatch.io/check/pnpm-lock-yaml (runs in the browser; the file is never uploaded) pnpm-lock.yaml pins the exact version of every package in your store, including the full transitive graph, so it gives a confirmed answer. We support both the v6 and v9 lockfile layouts. ## What we read from this file - v6 layout - a single `packages` map with `/name/version` keys - v9 layout - split `packages` and `snapshots` maps with `name@version` keys - `importers`, so we can tell your direct dependencies apart from transitive ones - peer-resolution suffixes such as `name@1.2.3(react@18.3.1)`, which we strip back to the real version ## How confident is a match? pnpm lockfiles pin exact resolved versions, so every match is confirmed rather than probable. ## Workspaces are covered In a pnpm monorepo the root lockfile carries every workspace package under `importers`. Pasting the single root pnpm-lock.yaml therefore checks the whole repo at once - you do not need to scan each package separately. ## The content-addressable store does not protect you pnpm’s store deduplicates by content hash, which is excellent for disk usage but has no bearing on whether the content is malicious. A compromised version hashes and stores exactly like a clean one. ## Frequently asked questions ### Which pnpm lockfile versions are supported? v6 and v9, which between them cover pnpm 8 and 9 onwards. The two use noticeably different key shapes, so we detect the layout and read whichever applies rather than assuming one. ### Do I need to scan every workspace in my monorepo? No. The root pnpm-lock.yaml already contains the resolved graph for all workspace packages, so one paste covers everything. ### Does pnpm’s stricter node_modules layout prevent supply-chain attacks? It prevents *phantom dependencies* - code importing packages it never declared. That is a genuine robustness win, but it does nothing about a package you did declare being compromised, or a transitive dependency of it being compromised. That is what this checks. ## Recent npm incidents The most recent of 165 tracked incidents affecting this ecosystem. Full feed: https://dependencywatch.io/feed - 2026-10-13 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-13 (**Baileys/libsignal lure operator wave 3** - 60+ npm packages across `@revizahoshii/*`, `@fazzcodestudio/*`, `@sanzoffc/*`, `@wanzlonely/*`, `@mikudeveloper/*`, `@modss/*`, `@ikanngeming/*`, `@fhkryxv/*`, `@saazkira/*`, `@badzz88/*`, `@alipclutch/*`, `@mivesensei/*`, `@kanaraa/*`, `@chatunity/*`, `@zanta/*`, `@yudzxml/*`, `@zeronexcode/*`, plus `baileys-xbats`/`bailslonely`/`nakkinpm`/`amprem` unscoped - all CWE-506 boilerplate takedowns against `@WhiskeySockets/Baileys` WhatsApp-automation lures; **confirmed-payload carve-outs within the sweep**: PyPI `npp-ml` Notepad++ impersonator deploying ADExplorer AD-recon tool, PyPI `minecraftaccfinder` Gmail/Roblox/Discord/Minecraft infostealer+RAT with keylogger/screenshots/browser-creds, RubyGems `wallet-balance-scanner` fake-native-extension reverse-shell to hardcoded endpoint; **s4yhii wave 3 continuation** `@s4yhiitestpoc/r2-https-b` on `collector.oob.s4yhii.com`; plus 25+ dep-confusion probes at `99.x`/`100.x`/`101.x` sentinels: `@myorder-frontend-commons/*`, `risk-detection`, `unified-platform`, `@pinecone-experience/*`, `@airbnb-extended/*`, `@tesla-insurance/*`, `@user-services/*`, `app-sca-info-banking`, `com.apple.unityplugin.storekit` Apple-brand impersonator, and more)](https://dependencywatch.io/incident/multi-2026-10-13-ghsa-malware-sweep) - 2026-10-12 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-12 (**s4yhii operator wave 3**: 8 npm packages across `@s4yhiitestpoc/*` + `@coopeuch/*` Coopeuch-brand dep-confusion all beaconing `collector.oob.s4yhii.com/_npm-poc/beacon`; **`185.158.107.175:8787/_ah/dc` operator wave 2**: 6 npm `beacon.cjs`-pattern recon packages (`nitro-cjs-requirer`, `nitro-bundled-dep`, `nested-lib`, `cloudflare_module`, `another-very-long-name`, `some-very-long-package-name`); **`64.181.165.115/dc` native-addon operator**: 4 npm packages with HTTP/1.0 raw-socket beacons (`ksp-app`, `ksp-client-registry`, `pay-methods-kmf`, `deposit-limit-fe`); `liferay-workspace-scripts` bundled-dep from `ltidi.storage.googleapis.com/depenconf/`; `react-dropzone-v4`/`react-paginate-v5`/`kmf-vendor-pack`/`exodus-firestore-synchronize` dep-confusion probes; `hardhat-option@2.0.1` npm `hardhat-promised`-family stealer; `css-nesting-transform@1.0.0` Wix-brand `webhook.site` recon; PyPI `ig-gox` (`goxtools.shop` encrypted-loader) + `py2ops` trojaned-REPL. Big RubyGems wgkit wave-2 crypto cluster split out to its own carve-out.)](https://dependencywatch.io/incident/multi-2026-10-12-ghsa-malware-sweep) - 2026-10-12 · [high, malicious package] [npm `hridoy-ultimate@8.0.0` ships Facebook email + password + TOTP 2FA secrets to `minhdong.site/api/v1/facebook/login_ios` and pins its `fca-unofficial` dep at `VangBanLaNhat/fca-unofficial#HEAD`](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer) - 2026-10-11 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-11 (new `webreader` + `pafer` PyPI two-package pickle-execution RAT with disclosed `frjmzbjbhwvtdnsuodmu.supabase.co` + `api.npoint.io/40e32d283a9d97e59252/a` C2 and `.pth` persistence, where the main package hides the pickle and the mandatory dependency unpickles it; new `agentaix` PyPI 3-package first-publish RAT cluster (`agentaix`, `agent-vx`, `media-manager5`) with autorun persistence beaconing `googleforum.pythonanywhere.com`; and standalone `@library-wide/library-shell@99.9.1` npm dep-confusion sentinel flagged by OpenSSF Package Analysis for malicious-domain egress)](https://dependencywatch.io/incident/multi-2026-10-11-ghsa-malware-sweep) - 2026-10-10 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-10 (new `s4yhii` native-binary credential-stealer dep-confusion operator - 16 npm packages across `@galicia-toolkit-nestjs/*`, `@galicia-toolkit-nestjs-20/*`, `@galicia-toolkit-nestjs-20-lite/*`, `@galicia-toolkit-cheques-nc/*`, `@brick-v2/*` loading prebuilds/-/metrics.node ELF+PE that forks+setsid and exfils AWS/GitHub/npm/Azure DevOps/Actions tokens to oob.s4yhii.com/native; `@tunstock/remact-dom@19.2.0` react-dom typosquat with confirmed `tele.metry.orgin.net/api/v1/events` beacon; Baileys/libsignal lure continuation `@fer2809fl/baileys`+`cloud-baileys`+`arsya-baileys`+10-package `asepxyz*` cluster; crates.io `sharpnes` Telegram-Desktop + Chrome-extension/wallet infostealer (first cargo malware advisory this week); 3-package `kmf-*` + 2-package internal-frontend dep-confusion with oast.pro OAST; 5-package `@tvg-mar/*` dep-confusion probes; 2 Tailwind typosquats; plus pypi `ig-gox` Instagram abuse)](https://dependencywatch.io/incident/multi-2026-10-10-ghsa-malware-sweep) - 2026-10-09 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-09 (xwise8887 wave-2 continuation `wie888r`/`testrrrd`/`xblaxw`/`@wxwxtest/testrrrdd` to `185.158.107.175:8787/_ah/dc`; Wix dep-confusion cluster `wix-reg-poc-bypass` (webhook.site) + `css-overscroll-contain` (dxpoc.gt.tc, K8s SA-token theft + container escape); `pxnpm` nfjbill-operator npm proxy weaponization (same operator as 2026-08 `yakuza0`); 16-package `@bellaxchuu/*` + sibling Baileys-themed lure cluster; 6-package `@dransay/*` oast.site dep-confusion probes; `@bitwardne/*` 2-package Bitwarden typosquat; 5-package `@galicia-toolkit/*`+`@design-system-coopeuch/web` dep-confusion cluster; 9 dev-tooling typosquats; 2 pypi `kafka-roller`/`kafka-helmsman` 99.x dep-confusion probes; plus standalones)](https://dependencywatch.io/incident/multi-2026-10-09-ghsa-malware-sweep) - 2026-10-08 · [critical, compromise] [`tensorlake` npm maintainer-account compromise - malicious `0.5.144` published one patch above the real `0.5.143` latest and quarantined by npm security](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise) - 2026-10-08 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-08 (named compromise carve-out: `tensorlake@0.5.144` maintainer-account compromise; plus npm `internallib_v788` wave-3 continuation of the `internallib_v` RFC1918 reverse-shell operator; new npm `troubleshooting`/`browser-metrics-plugin.contrib` dep-confusion probe from `xwise8887` with HTTP beacon to `185.158.107.175:8787`; new npm `personio-pipeline-projen` dep-confusion probe from `reaperhackbot256f` with `oast.fun`+`oastify.com` DNS/HTTPS exfil; new npm `imgbundle`+`cdn-img-fetch` img-themed sleeper cluster from `malfexteste2`; npm `function-color@1.7.3`+`function-flag@1.7.3` 2025-08-04 backfilled low-version sideload sleepers caught today; 3-package npm `@ikyyjee/ikkysingle`/`ikyysingle`/`ikyysinggle` typosquat burst; 2 Amazon-Inspector namespace-holder takedowns `windows_registry_editor`/`store-webpack-config`; and 5 CWE-506 boilerplate takedowns)](https://dependencywatch.io/incident/multi-2026-10-08-ghsa-malware-sweep) ## Other manifest formats - package-lock.json (npm): https://dependencywatch.io/check/package-lock-json - package.json (npm): https://dependencywatch.io/check/package-json - yarn.lock (Yarn): https://dependencywatch.io/check/yarn-lock - requirements.txt (pip): https://dependencywatch.io/check/requirements-txt --- Canonical page: https://dependencywatch.io/check/pnpm-lock-yaml Markdown version: https://dependencywatch.io/check/pnpm-lock-yaml.md Site index for agents: https://dependencywatch.io/llms.txt DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).