Lazaretto: check your pinned dependencies against published malicious-package advisories.
Free, no account, no key, nothing installed.

  curl -s https://lazaretto.dev/check --data-binary @package-lock.json

Works with package-lock.json, npm-shrinkwrap.json, yarn.lock, or pnpm-lock.yaml.
Only exactly pinned versions can be checked: a range like ^5.0.0 has no definitive
answer, because a compromised release usually sits between clean ones.

In CI, the same check as a GitHub Action:
  https://github.com/marketplace/actions/lazaretto-scan

Machine-readable contract: https://lazaretto.dev/llms.txt