Lazaretto · evidence

Real incidents, reproducible verdicts

Every claim below can be checked with one free command against the live API. These are identity matches against published malicious-package advisories (OSV / OpenSSF); the behavioral rule engine is a separate layer with its own evidence. Detection is inherently imperfect and this page is not a claim of completeness: what we get wrong goes in the public corrections log, and what the data cannot tell you is listed in sources.

`chalk@5.6.1` known malware

September 2025 maintainer-account compromise of one of the most downloaded packages on npm. The malicious release sat between clean ones. Advisory: MAL-2025-46969.

Reproduce it yourself, free, no key:

curl -s -X POST https://lazaretto.dev/v1/lockfile \
  -H 'content-type: application/json' \
  -d '{"lockfileVersion":3,"packages":{"":{"name":"repro","version":"1.0.0"},"node_modules/chalk":{"version":"5.6.1"}}}'

Its clean neighbour chalk@5.3.0 comes back with an empty malicious list from the same command. Version scoping is the point: the compromised release usually sits between clean ones.

`debug@4.4.2` known malware

Compromised in the same September 2025 wave. The surrounding releases were not. Advisory: MAL-2025-46974.

Reproduce it yourself, free, no key:

curl -s -X POST https://lazaretto.dev/v1/lockfile \
  -H 'content-type: application/json' \
  -d '{"lockfileVersion":3,"packages":{"":{"name":"repro","version":"1.0.0"},"node_modules/debug":{"version":"4.4.2"}}}'

Its clean neighbour debug@4.3.4 comes back with an empty malicious list from the same command. Version scoping is the point: the compromised release usually sits between clean ones.

`@ledgerhq/connect-kit@1.1.6` known malware

December 2023 supply-chain attack on a crypto wallet connector. Malicious only in 1.1.5 through 1.1.7; releases either side are reported clean, because condemning a project’s clean releases would be a false accusation. Advisory: MAL-2023-8697.

Reproduce it yourself, free, no key:

curl -s -X POST https://lazaretto.dev/v1/lockfile \
  -H 'content-type: application/json' \
  -d '{"lockfileVersion":3,"packages":{"":{"name":"repro","version":"1.0.0"},"node_modules/@ledgerhq/connect-kit":{"version":"1.1.6"}}}'

Its clean neighbour @ledgerhq/connect-kit@1.1.8 comes back with an empty malicious list from the same command. Version scoping is the point: the compromised release usually sits between clean ones.

`electron-native-notify@1.0.0` known malware

A package whose whole identity is malware. It was removed from the registry after publication, so Lazaretto reports it on package identity even though there are no bytes left to fetch. Advisory: MAL-2025-19452.

Reproduce it yourself, free, no key:

curl -s -X POST https://lazaretto.dev/v1/lockfile \
  -H 'content-type: application/json' \
  -d '{"lockfileVersion":3,"packages":{"":{"name":"repro","version":"1.0.0"},"node_modules/electron-native-notify":{"version":"1.0.0"}}}'

`node-ipc@9.2.3` known malware

Sabotage releases shipped by the maintainer. Listed versions are flagged; unaffected versions are not. Advisory: MAL-2026-3744.

Reproduce it yourself, free, no key:

curl -s -X POST https://lazaretto.dev/v1/lockfile \
  -H 'content-type: application/json' \
  -d '{"lockfileVersion":3,"packages":{"":{"name":"repro","version":"1.0.0"},"node_modules/node-ipc":{"version":"9.2.3"}}}'

Its clean neighbour node-ipc@11.1.0 comes back with an empty malicious list from the same command. Version scoping is the point: the compromised release usually sits between clean ones.

Check your own tree

curl -s -X POST https://lazaretto.dev/v1/lockfile \
  -H 'content-type: application/json' --data @package-lock.json

Free, no key. Or two lines in CI: the GitHub Action. Or give your agent the MCP server: https://lazaretto.dev/mcp.