npm Lockfile Checker
Scan your package-lock.json, pnpm-lock.yaml, yarn.lock, or bun.lock for known malware and vulnerabilities. Your lockfile never leaves your browser; only package names and versions are sent to OSV.dev.
- Free · no signup
- Malware flagged first
- Lockfile stays in your browser
Your lockfile never leaves your browser. Only package names and versions are sent to OSV.dev.
Check a lockfile for npm malware
Your lockfile records the exact version of every package that gets installed, which makes it the right thing to check after a supply-chain attack is announced. This tool reads it locally, lists each name@version, and asks OSV.dev whether any of them are known to be malicious or vulnerable.
Malware is reported first and marked critical. Vulnerabilities follow, with severity and a fixed version when one is published. A scan that could not finish is reported as partial, never as clean.
How it works
- 1
Paste the contents of your lockfile or drop the file onto the checker. It supports package-lock.json, pnpm-lock.yaml, yarn.lock (classic and Berry), and the text bun.lock. Supported versions: npm lockfileVersion 2-3 (npm 7+), pnpm-lock v6 and v9, yarn.lock v1 and Berry, and text bun.lock (a binary bun.lockb must be re-saved as text).
- 2
The tool parses the lockfile in your browser and builds a de-duplicated list of package names and versions. Workspace, git, and file dependencies are counted as skipped because they are not on the npm registry.
- 3
Those names and versions are checked against OSV.dev in batches. Known malware advisories are separated from ordinary vulnerabilities and shown first.
- 4
Review the findings, then follow the steps for each hit: pin a fixed or known-good version, and if a package is flagged as malware, treat the machine that installed it as compromised.
Frequently asked questions
What does this lockfile checker look for?
It checks every registry package version in your lockfile against the OSV.dev database. That covers known malware advisories (the MAL- records for malicious packages) as well as known vulnerabilities from sources such as GitHub Security Advisories. Each finding shows the package, the installed version, the advisory ID (all related IDs are in the JSON export), and a fixed version when one exists.
Why is malware shown before vulnerabilities?
A vulnerability is a bug that an attacker may be able to exploit, and you can usually schedule the upgrade. Malware is different: the package was written to do harm, often through an install script that runs the moment you install it. Recent npm supply-chain attacks show why a malicious version can matter more than any CVE, so those hits are listed first and marked critical.
What does a clean result mean?
A clean result means no match was found in OSV at the time of the scan. It is not a guarantee of safety: brand-new attacks may not be listed yet, because advisories are published after a compromise is discovered and reported. The clean message is shown only when every batch of the scan completed. If any batch failed, the tool reports a partial result and says how many packages were not checked.
Is my lockfile uploaded anywhere?
No. Your lockfile is parsed entirely in your browser and never leaves it. The only data sent to OSV.dev is the package name and version of each dependency, with the npm ecosystem. Your project name, file paths, registry URLs, and integrity hashes are not sent.
What should I do if my lockfile has a malware hit?
Treat the machine or CI runner that installed the package as compromised. Rotate any credentials it could reach, such as npm tokens, cloud keys, and SSH keys. Clear the npm cache, delete node_modules, and pin a known-good version of the package. Reinstall with --ignore-scripts so install scripts cannot run while you clean up, and then review your lockfile diff to see when the bad version entered.
More developer tools
Browse the full set of free, browser-based developer tools from jsmanifest.