Evidence
Real incidents, reproducible verdicts
You can check each claim below with one free command against the live API. These are matches by name and version against published OSV and OpenSSF malware lists. A full scan is a separate layer that reads the code, with its own evidence.
No detection is perfect, and this list is not complete. What we get wrong goes in the public corrections log. What the data cannot tell you is in sources. How often we flag a package people install on purpose is on the benchmark page.
chalk@5.6.1 known malware
A maintainer account for this widely used package was taken over in September 2025. The bad release sat between clean ones. Advisory: MAL-2025-46969.
Reproduce it yourself, free, no key:
curl -s -X POST https://lazaretto.dev/v1/lockfile \
-H 'content-type: application/json' \
-d '{"lockfileVersion":3,"packages":{"":{"name":"repro","version":"1.0.0"},"node_modules/chalk":{"version":"5.6.1"}}}'
Its clean neighbour chalk@5.3.0 comes back with an empty malicious list from the same command. This is why the version matters: a bad release can sit between clean ones.
debug@4.4.2 known malware
Compromised in the same September 2025 wave. The surrounding releases were not. Advisory: MAL-2025-46974.
Reproduce it yourself, free, no key:
curl -s -X POST https://lazaretto.dev/v1/lockfile \
-H 'content-type: application/json' \
-d '{"lockfileVersion":3,"packages":{"":{"name":"repro","version":"1.0.0"},"node_modules/debug":{"version":"4.4.2"}}}'
Its clean neighbour debug@4.3.4 comes back with an empty malicious list from the same command. This is why the version matters: a bad release can sit between clean ones.
@ledgerhq/connect-kit@1.1.6 known malware
An attack on a crypto wallet tool in December 2023. Only 1.1.5 through 1.1.7 were bad. We report the releases on either side as clean, since calling them bad would be a false charge. Advisory: MAL-2023-8697.
Reproduce it yourself, free, no key:
curl -s -X POST https://lazaretto.dev/v1/lockfile \
-H 'content-type: application/json' \
-d '{"lockfileVersion":3,"packages":{"":{"name":"repro","version":"1.0.0"},"node_modules/@ledgerhq/connect-kit":{"version":"1.1.6"}}}'
Its clean neighbour @ledgerhq/connect-kit@1.1.8 comes back with an empty malicious list from the same command. This is why the version matters: a bad release can sit between clean ones.
electron-native-notify@1.0.0 known malware
A package that was malware from the start. The registry removed it, so we report it by name and version. There are no files left to fetch. Advisory: MAL-2025-19452.
Reproduce it yourself, free, no key:
curl -s -X POST https://lazaretto.dev/v1/lockfile \
-H 'content-type: application/json' \
-d '{"lockfileVersion":3,"packages":{"":{"name":"repro","version":"1.0.0"},"node_modules/electron-native-notify":{"version":"1.0.0"}}}'
node-ipc@9.2.3 known malware
The maintainer shipped sabotage in some releases. We flag the listed versions and leave the others alone. Advisory: MAL-2026-3744.
Reproduce it yourself, free, no key:
curl -s -X POST https://lazaretto.dev/v1/lockfile \
-H 'content-type: application/json' \
-d '{"lockfileVersion":3,"packages":{"":{"name":"repro","version":"1.0.0"},"node_modules/node-ipc":{"version":"9.2.3"}}}'
Its clean neighbour node-ipc@11.1.0 comes back with an empty malicious list from the same command. This is why the version matters: a bad release can sit between clean ones.
Check your own tree
curl -s -X POST https://lazaretto.dev/v1/lockfile \ -H 'content-type: application/json' --data @package-lock.json
Free, no key. Or two lines in CI:
the GitHub Action. Or give your
agent the MCP server: https://lazaretto.dev/mcp.