Home / lockfile check

Check your lockfile for known malware

Your lockfile names the exact version of every package you install, including the ones you never chose yourself. Upload it and each exactly pinned version is matched against published malicious-package advisories from OSV and OpenSSF. Nothing is installed or run, and the file is not stored.

package-lock.json, yarn.lock or pnpm-lock.yaml. Free, no account. Checked against published malicious-package advisories and not stored.

From a terminal

curl -s https://lazaretto.dev/check --data-binary @package-lock.json

Also reads npm-shrinkwrap.json, yarn.lock and pnpm-lock.yaml. No key.

What the answer means

• A match names the package, the version and the advisory, so you can remove or upgrade it before you install.
• Only exact versions have an honest answer. A range like ^5.0.0 does not, because a compromised release usually sits between clean ones.
• This matches names and versions against reports. It cannot see a malicious release nobody has reported yet, so no match is not a statement that a package carries no risk.

Where the advisories come from. How to tell if an npm package is malicious.

Run it on every pull request

A compromised release usually lands as an ordinary version bump. Add this file as .github/workflows/lazaretto.yml and every pull request gets this check, with the result as a comment. Free, no key.

name: Lazaretto
on: [pull_request]
permissions:
  contents: read
  pull-requests: write
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: jamesdfinance-dev/lazaretto-scan-action@v2

From your agent

The same check is the check_lockfile tool on our MCP server. No key. Setup for every client. To read the code of a package rather than match its name, see the developer guide.