How to check your lockfile for malicious packages, free and without installing anything

Your lockfile names the exact version of every package you install. That includes the deep ones you never picked. A bad version can arrive as an ordinary version bump. The cheap check is to take each pinned version and ask if it has already been reported as malware.

What the check matches

Upload a package-lock.json, yarn.lock, pnpm-lock.yaml or npm-shrinkwrap.json to the free lockfile check. It reads the file. It takes each pinned name and version. It matches them against published malware reports from OSV and OpenSSF, which we sync each day. It needs no account. It installs nothing, runs nothing, and does not store your file.

Be clear on the boundary. This matches names and versions against reports. It does not read the code inside your packages. So it finds a release that has been reported, and it misses a bad release that no one has reported yet. No match means we hold no report on those versions, nothing more. Reading the code is a separate, deeper check.

Only an exact version has a clear answer. A range like ^5.0.0 does not. A bad release can sit between clean ones, and a range can land on either. A lockfile helps because it pins exact versions.

A real one you would want caught

On 8 September 2025, version 5.6.1 of chalk shipped malware. chalk is one of the most used packages on npm. The bad code went in after the owner's account was taken over. It is listed as MAL-2025-46969 in the OSV and OpenSSF reports. If your lockfile pins chalk@5.6.1, the check names it, with the version and a link to the advisory. You can remove or upgrade it before you install.

From a terminal it is one call over the whole file, no loop:

curl -s https://lazaretto.dev/check --data-binary @package-lock.json

A report can come after you install

chalk was a normal package. Then one version shipped malware. A version with no report today can get one tomorrow. So one check does not settle it.

Keep it checked in two ways. Add the lockfile check to CI as a GitHub Action. Every pull request that changes a dependency gets the same match, with the result as a comment, no key. Or register your packages once with /v1/watch. Read it back later to see if any of them has been reported as malware since. A watch stores the package names and what we knew then. It never stores your lockfile or code. You read it by polling, so a daily CI job is enough. A watch costs one credit to set up. Reading it is free.

Check yours

Upload your lockfile at the free lockfile check. It names any pinned version that is listed as malware. Nothing is stored.