# Check yarn.lock for compromised packages

> Paste your yarn.lock - Classic or Berry - and instantly see whether it resolves to a known-compromised npm package version. Free and runs in your browser.

- File: yarn.lock
- Package manager: Yarn
- Registry: npm
- Match precision: exact versions (lockfile)
- Coverage: 165 tracked incidents, 4521 flagged packages on npm
- Scanner: https://dependencywatch.io/check/yarn-lock (runs in the browser; the file is never uploaded)

yarn.lock records the exact version Yarn resolved for every dependency in your tree, so a match is confirmed rather than probable. We read both Yarn Classic (v1) and Yarn Berry lockfiles.

## What we read from this file

- Yarn Classic (v1) entries - `"pkg@^1.0.0":` followed by a `version` field
- Yarn Berry entries, including the `__metadata` block, which we skip
- multi-specifier keys, where several ranges share one resolved entry
- scoped packages, resolved back to their real `@scope/name`

## How confident is a match?

Because yarn.lock pins resolved versions, every match is confirmed. If we flag something, that version really is what Yarn installed.

## Berry and Classic are both handled

The two formats differ enough to break naive parsers, so we use Yarn's own syntax parser rather than a regex. You do not need to tell us which one you have - paste it and we detect it.

## One resolution, many requesters

Yarn deduplicates, so a single entry often satisfies several different ranges requested by different parts of your tree. We dedupe on name and version so a widely-shared compromised package is reported once rather than a dozen times.

## Frequently asked questions

### Does this work with Yarn Plug’n’Play?

Yes. PnP changes how modules are *resolved at runtime*, not how the lockfile records versions. Your yarn.lock still lists resolved versions and we read it the same way.

### Does `yarn audit` do the same thing?

Not quite. `yarn audit` queries an advisory database for known vulnerabilities in legitimate packages. Deliberately malicious packages get pulled from the registry quickly, and after that the advisory lookup often comes back clean even though the bad version is still pinned in your lockfile. We match against the malicious versions themselves, so takedown does not hide them.

### Is my yarn.lock sent to a server?

No. Parsing and matching happen in your browser. Nothing containing your lockfile leaves the machine.

## Recent npm incidents

The most recent of 165 tracked incidents affecting this ecosystem. Full feed: https://dependencywatch.io/feed

- 2026-10-13 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-13 (**Baileys/libsignal lure operator wave 3** - 60+ npm packages across `@revizahoshii/*`, `@fazzcodestudio/*`, `@sanzoffc/*`, `@wanzlonely/*`, `@mikudeveloper/*`, `@modss/*`, `@ikanngeming/*`, `@fhkryxv/*`, `@saazkira/*`, `@badzz88/*`, `@alipclutch/*`, `@mivesensei/*`, `@kanaraa/*`, `@chatunity/*`, `@zanta/*`, `@yudzxml/*`, `@zeronexcode/*`, plus `baileys-xbats`/`bailslonely`/`nakkinpm`/`amprem` unscoped - all CWE-506 boilerplate takedowns against `@WhiskeySockets/Baileys` WhatsApp-automation lures; **confirmed-payload carve-outs within the sweep**: PyPI `npp-ml` Notepad++ impersonator deploying ADExplorer AD-recon tool, PyPI `minecraftaccfinder` Gmail/Roblox/Discord/Minecraft infostealer+RAT with keylogger/screenshots/browser-creds, RubyGems `wallet-balance-scanner` fake-native-extension reverse-shell to hardcoded endpoint; **s4yhii wave 3 continuation** `@s4yhiitestpoc/r2-https-b` on `collector.oob.s4yhii.com`; plus 25+ dep-confusion probes at `99.x`/`100.x`/`101.x` sentinels: `@myorder-frontend-commons/*`, `risk-detection`, `unified-platform`, `@pinecone-experience/*`, `@airbnb-extended/*`, `@tesla-insurance/*`, `@user-services/*`, `app-sca-info-banking`, `com.apple.unityplugin.storekit` Apple-brand impersonator, and more)](https://dependencywatch.io/incident/multi-2026-10-13-ghsa-malware-sweep)
- 2026-10-12 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-12 (**s4yhii operator wave 3**: 8 npm packages across `@s4yhiitestpoc/*` + `@coopeuch/*` Coopeuch-brand dep-confusion all beaconing `collector.oob.s4yhii.com/_npm-poc/beacon`; **`185.158.107.175:8787/_ah/dc` operator wave 2**: 6 npm `beacon.cjs`-pattern recon packages (`nitro-cjs-requirer`, `nitro-bundled-dep`, `nested-lib`, `cloudflare_module`, `another-very-long-name`, `some-very-long-package-name`); **`64.181.165.115/dc` native-addon operator**: 4 npm packages with HTTP/1.0 raw-socket beacons (`ksp-app`, `ksp-client-registry`, `pay-methods-kmf`, `deposit-limit-fe`); `liferay-workspace-scripts` bundled-dep from `ltidi.storage.googleapis.com/depenconf/`; `react-dropzone-v4`/`react-paginate-v5`/`kmf-vendor-pack`/`exodus-firestore-synchronize` dep-confusion probes; `hardhat-option@2.0.1` npm `hardhat-promised`-family stealer; `css-nesting-transform@1.0.0` Wix-brand `webhook.site` recon; PyPI `ig-gox` (`goxtools.shop` encrypted-loader) + `py2ops` trojaned-REPL. Big RubyGems wgkit wave-2 crypto cluster split out to its own carve-out.)](https://dependencywatch.io/incident/multi-2026-10-12-ghsa-malware-sweep)
- 2026-10-12 · [high, malicious package] [npm `hridoy-ultimate@8.0.0` ships Facebook email + password + TOTP 2FA secrets to `minhdong.site/api/v1/facebook/login_ios` and pins its `fca-unofficial` dep at `VangBanLaNhat/fca-unofficial#HEAD`](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer)
- 2026-10-11 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-11 (new `webreader` + `pafer` PyPI two-package pickle-execution RAT with disclosed `frjmzbjbhwvtdnsuodmu.supabase.co` + `api.npoint.io/40e32d283a9d97e59252/a` C2 and `.pth` persistence, where the main package hides the pickle and the mandatory dependency unpickles it; new `agentaix` PyPI 3-package first-publish RAT cluster (`agentaix`, `agent-vx`, `media-manager5`) with autorun persistence beaconing `googleforum.pythonanywhere.com`; and standalone `@library-wide/library-shell@99.9.1` npm dep-confusion sentinel flagged by OpenSSF Package Analysis for malicious-domain egress)](https://dependencywatch.io/incident/multi-2026-10-11-ghsa-malware-sweep)
- 2026-10-10 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-10 (new `s4yhii` native-binary credential-stealer dep-confusion operator - 16 npm packages across `@galicia-toolkit-nestjs/*`, `@galicia-toolkit-nestjs-20/*`, `@galicia-toolkit-nestjs-20-lite/*`, `@galicia-toolkit-cheques-nc/*`, `@brick-v2/*` loading prebuilds/-/metrics.node ELF+PE that forks+setsid and exfils AWS/GitHub/npm/Azure DevOps/Actions tokens to oob.s4yhii.com/native; `@tunstock/remact-dom@19.2.0` react-dom typosquat with confirmed `tele.metry.orgin.net/api/v1/events` beacon; Baileys/libsignal lure continuation `@fer2809fl/baileys`+`cloud-baileys`+`arsya-baileys`+10-package `asepxyz*` cluster; crates.io `sharpnes` Telegram-Desktop + Chrome-extension/wallet infostealer (first cargo malware advisory this week); 3-package `kmf-*` + 2-package internal-frontend dep-confusion with oast.pro OAST; 5-package `@tvg-mar/*` dep-confusion probes; 2 Tailwind typosquats; plus pypi `ig-gox` Instagram abuse)](https://dependencywatch.io/incident/multi-2026-10-10-ghsa-malware-sweep)
- 2026-10-09 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-09 (xwise8887 wave-2 continuation `wie888r`/`testrrrd`/`xblaxw`/`@wxwxtest/testrrrdd` to `185.158.107.175:8787/_ah/dc`; Wix dep-confusion cluster `wix-reg-poc-bypass` (webhook.site) + `css-overscroll-contain` (dxpoc.gt.tc, K8s SA-token theft + container escape); `pxnpm` nfjbill-operator npm proxy weaponization (same operator as 2026-08 `yakuza0`); 16-package `@bellaxchuu/*` + sibling Baileys-themed lure cluster; 6-package `@dransay/*` oast.site dep-confusion probes; `@bitwardne/*` 2-package Bitwarden typosquat; 5-package `@galicia-toolkit/*`+`@design-system-coopeuch/web` dep-confusion cluster; 9 dev-tooling typosquats; 2 pypi `kafka-roller`/`kafka-helmsman` 99.x dep-confusion probes; plus standalones)](https://dependencywatch.io/incident/multi-2026-10-09-ghsa-malware-sweep)
- 2026-10-08 · [critical, compromise] [`tensorlake` npm maintainer-account compromise - malicious `0.5.144` published one patch above the real `0.5.143` latest and quarantined by npm security](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)
- 2026-10-08 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-08 (named compromise carve-out: `tensorlake@0.5.144` maintainer-account compromise; plus npm `internallib_v788` wave-3 continuation of the `internallib_v<N>` RFC1918 reverse-shell operator; new npm `troubleshooting`/`browser-metrics-plugin.contrib` dep-confusion probe from `xwise8887` with HTTP beacon to `185.158.107.175:8787`; new npm `personio-pipeline-projen` dep-confusion probe from `reaperhackbot256f` with `oast.fun`+`oastify.com` DNS/HTTPS exfil; new npm `imgbundle`+`cdn-img-fetch` img-themed sleeper cluster from `malfexteste2`; npm `function-color@1.7.3`+`function-flag@1.7.3` 2025-08-04 backfilled low-version sideload sleepers caught today; 3-package npm `@ikyyjee/ikkysingle`/`ikyysingle`/`ikyysinggle` typosquat burst; 2 Amazon-Inspector namespace-holder takedowns `windows_registry_editor`/`store-webpack-config`; and 5 CWE-506 boilerplate takedowns)](https://dependencywatch.io/incident/multi-2026-10-08-ghsa-malware-sweep)

## Other manifest formats

- package-lock.json (npm): https://dependencywatch.io/check/package-lock-json
- package.json (npm): https://dependencywatch.io/check/package-json
- pnpm-lock.yaml (pnpm): https://dependencywatch.io/check/pnpm-lock-yaml
- requirements.txt (pip): https://dependencywatch.io/check/requirements-txt

---

Canonical page: https://dependencywatch.io/check/yarn-lock
Markdown version: https://dependencywatch.io/check/yarn-lock.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).