---
title: "npm package security scans. Lazaretto"
description: "Automated Lazaretto scan results for widely-used npm packages: known-bad matching plus deterministic behavioral signals."
url: "https://lazaretto.dev/packages"
---

[Home](https://lazaretto.dev/) / reports

# npm package security scans

Automated scan results for widely-used npm packages. Each page shows the verdict and the signal categories; the full evidence is in the report from the API. Results are automated signals, not a warranty. Looking for agent tooling? See the [MCP server reports](https://lazaretto.dev/mcp-servers).

- [react](https://lazaretto.dev/package/npm/react)
- [react-dom](https://lazaretto.dev/package/npm/react-dom)
- [lodash](https://lazaretto.dev/package/npm/lodash)
- [axios](https://lazaretto.dev/package/npm/axios)
- [express](https://lazaretto.dev/package/npm/express)
- [chalk](https://lazaretto.dev/package/npm/chalk)
- [commander](https://lazaretto.dev/package/npm/commander)
- [debug](https://lazaretto.dev/package/npm/debug)
- [moment](https://lazaretto.dev/package/npm/moment)
- [dayjs](https://lazaretto.dev/package/npm/dayjs)
- [uuid](https://lazaretto.dev/package/npm/uuid)
- [dotenv](https://lazaretto.dev/package/npm/dotenv)
- [classnames](https://lazaretto.dev/package/npm/classnames)
- [redux](https://lazaretto.dev/package/npm/redux)
- [zustand](https://lazaretto.dev/package/npm/zustand)
- [next](https://lazaretto.dev/package/npm/next)
- [vue](https://lazaretto.dev/package/npm/vue)
- [svelte](https://lazaretto.dev/package/npm/svelte)
- [typescript](https://lazaretto.dev/package/npm/typescript)
- [eslint](https://lazaretto.dev/package/npm/eslint)
- [prettier](https://lazaretto.dev/package/npm/prettier)
- [webpack](https://lazaretto.dev/package/npm/webpack)
- [vite](https://lazaretto.dev/package/npm/vite)
- [rollup](https://lazaretto.dev/package/npm/rollup)
- [esbuild](https://lazaretto.dev/package/npm/esbuild)
- [babel-core](https://lazaretto.dev/package/npm/babel-core)
- [jest](https://lazaretto.dev/package/npm/jest)
- [vitest](https://lazaretto.dev/package/npm/vitest)
- [mocha](https://lazaretto.dev/package/npm/mocha)
- [chai](https://lazaretto.dev/package/npm/chai)
- [cypress](https://lazaretto.dev/package/npm/cypress)
- [playwright](https://lazaretto.dev/package/npm/playwright)
- [puppeteer](https://lazaretto.dev/package/npm/puppeteer)
- [cheerio](https://lazaretto.dev/package/npm/cheerio)
- [jsdom](https://lazaretto.dev/package/npm/jsdom)
- [node-fetch](https://lazaretto.dev/package/npm/node-fetch)
- [undici](https://lazaretto.dev/package/npm/undici)
- [got](https://lazaretto.dev/package/npm/got)
- [request](https://lazaretto.dev/package/npm/request)
- [ws](https://lazaretto.dev/package/npm/ws)
- [socket.io](https://lazaretto.dev/package/npm/socket.io)
- [graphql](https://lazaretto.dev/package/npm/graphql)
- [apollo-server](https://lazaretto.dev/package/npm/apollo-server)
- [mongoose](https://lazaretto.dev/package/npm/mongoose)
- [sequelize](https://lazaretto.dev/package/npm/sequelize)
- [prisma](https://lazaretto.dev/package/npm/prisma)
- [knex](https://lazaretto.dev/package/npm/knex)
- [pg](https://lazaretto.dev/package/npm/pg)
- [mysql2](https://lazaretto.dev/package/npm/mysql2)
- [redis](https://lazaretto.dev/package/npm/redis)
- [ioredis](https://lazaretto.dev/package/npm/ioredis)
- [bcrypt](https://lazaretto.dev/package/npm/bcrypt)
- [jsonwebtoken](https://lazaretto.dev/package/npm/jsonwebtoken)
- [passport](https://lazaretto.dev/package/npm/passport)
- [helmet](https://lazaretto.dev/package/npm/helmet)
- [cors](https://lazaretto.dev/package/npm/cors)
- [body-parser](https://lazaretto.dev/package/npm/body-parser)
- [multer](https://lazaretto.dev/package/npm/multer)
- [nodemailer](https://lazaretto.dev/package/npm/nodemailer)
- [winston](https://lazaretto.dev/package/npm/winston)
- [pino](https://lazaretto.dev/package/npm/pino)
- [yargs](https://lazaretto.dev/package/npm/yargs)
- [inquirer](https://lazaretto.dev/package/npm/inquirer)
- [ora](https://lazaretto.dev/package/npm/ora)
- [rimraf](https://lazaretto.dev/package/npm/rimraf)
- [glob](https://lazaretto.dev/package/npm/glob)
- [fs-extra](https://lazaretto.dev/package/npm/fs-extra)
- [semver](https://lazaretto.dev/package/npm/semver)
- [chokidar](https://lazaretto.dev/package/npm/chokidar)
- [nanoid](https://lazaretto.dev/package/npm/nanoid)
- [zod](https://lazaretto.dev/package/npm/zod)
- [yup](https://lazaretto.dev/package/npm/yup)
- [joi](https://lazaretto.dev/package/npm/joi)
- [ramda](https://lazaretto.dev/package/npm/ramda)
- [immer](https://lazaretto.dev/package/npm/immer)
- [rxjs](https://lazaretto.dev/package/npm/rxjs)
- [date-fns](https://lazaretto.dev/package/npm/date-fns)
- [sharp](https://lazaretto.dev/package/npm/sharp)
- [handlebars](https://lazaretto.dev/package/npm/handlebars)
- [ejs](https://lazaretto.dev/package/npm/ejs)
- [marked](https://lazaretto.dev/package/npm/marked)
- [highlight.js](https://lazaretto.dev/package/npm/highlight.js)
- [tailwindcss](https://lazaretto.dev/package/npm/tailwindcss)
- [postcss](https://lazaretto.dev/package/npm/postcss)
- [autoprefixer](https://lazaretto.dev/package/npm/autoprefixer)
- [sass](https://lazaretto.dev/package/npm/sass)
- [concurrently](https://lazaretto.dev/package/npm/concurrently)
- [nodemon](https://lazaretto.dev/package/npm/nodemon)
- [pm2](https://lazaretto.dev/package/npm/pm2)
- [cross-env](https://lazaretto.dev/package/npm/cross-env)
- [husky](https://lazaretto.dev/package/npm/husky)
- [lint-staged](https://lazaretto.dev/package/npm/lint-staged)
- [jquery](https://lazaretto.dev/package/npm/jquery)
- [underscore](https://lazaretto.dev/package/npm/underscore)
- [luxon](https://lazaretto.dev/package/npm/luxon)
- [validator](https://lazaretto.dev/package/npm/validator)
- [qs](https://lazaretto.dev/package/npm/qs)
- [deepmerge](https://lazaretto.dev/package/npm/deepmerge)
- [superagent](https://lazaretto.dev/package/npm/superagent)
- [form-data](https://lazaretto.dev/package/npm/form-data)
- [follow-redirects](https://lazaretto.dev/package/npm/follow-redirects)
- [gulp](https://lazaretto.dev/package/npm/gulp)
- [grunt](https://lazaretto.dev/package/npm/grunt)
- [browserify](https://lazaretto.dev/package/npm/browserify)
- [terser](https://lazaretto.dev/package/npm/terser)
- [ts-node](https://lazaretto.dev/package/npm/ts-node)
- [tsx](https://lazaretto.dev/package/npm/tsx)
- [ava](https://lazaretto.dev/package/npm/ava)
- [tape](https://lazaretto.dev/package/npm/tape)
- [sinon](https://lazaretto.dev/package/npm/sinon)
- [nyc](https://lazaretto.dev/package/npm/nyc)
- [supertest](https://lazaretto.dev/package/npm/supertest)
- [kleur](https://lazaretto.dev/package/npm/kleur)
- [picocolors](https://lazaretto.dev/package/npm/picocolors)
- [boxen](https://lazaretto.dev/package/npm/boxen)
- [prompts](https://lazaretto.dev/package/npm/prompts)
- [enquirer](https://lazaretto.dev/package/npm/enquirer)
- [meow](https://lazaretto.dev/package/npm/meow)
- [figlet](https://lazaretto.dev/package/npm/figlet)
- [immutable](https://lazaretto.dev/package/npm/immutable)
- [mobx](https://lazaretto.dev/package/npm/mobx)
- [xstate](https://lazaretto.dev/package/npm/xstate)
- [typeorm](https://lazaretto.dev/package/npm/typeorm)
- [better-sqlite3](https://lazaretto.dev/package/npm/better-sqlite3)
- [sqlite3](https://lazaretto.dev/package/npm/sqlite3)
- [mongodb](https://lazaretto.dev/package/npm/mongodb)
- [archiver](https://lazaretto.dev/package/npm/archiver)
- [adm-zip](https://lazaretto.dev/package/npm/adm-zip)
- [tar](https://lazaretto.dev/package/npm/tar)
- [unzipper](https://lazaretto.dev/package/npm/unzipper)
- [ajv](https://lazaretto.dev/package/npm/ajv)
- [crypto-js](https://lazaretto.dev/package/npm/crypto-js)
- [bcryptjs](https://lazaretto.dev/package/npm/bcryptjs)
- [argon2](https://lazaretto.dev/package/npm/argon2)
- [jose](https://lazaretto.dev/package/npm/jose)
- [pug](https://lazaretto.dev/package/npm/pug)
- [mustache](https://lazaretto.dev/package/npm/mustache)
- [nunjucks](https://lazaretto.dev/package/npm/nunjucks)
- [markdown-it](https://lazaretto.dev/package/npm/markdown-it)
- [cross-spawn](https://lazaretto.dev/package/npm/cross-spawn)
- [execa](https://lazaretto.dev/package/npm/execa)
- [shelljs](https://lazaretto.dev/package/npm/shelljs)
- [del](https://lazaretto.dev/package/npm/del)
- [minimist](https://lazaretto.dev/package/npm/minimist)
- [minimatch](https://lazaretto.dev/package/npm/minimatch)
- [fast-glob](https://lazaretto.dev/package/npm/fast-glob)
- [globby](https://lazaretto.dev/package/npm/globby)
- [cosmiconfig](https://lazaretto.dev/package/npm/cosmiconfig)
- [morgan](https://lazaretto.dev/package/npm/morgan)
- [compression](https://lazaretto.dev/package/npm/compression)
- [http-proxy](https://lazaretto.dev/package/npm/http-proxy)
- [node-cron](https://lazaretto.dev/package/npm/node-cron)
- [dompurify](https://lazaretto.dev/package/npm/dompurify)
- [sanitize-html](https://lazaretto.dev/package/npm/sanitize-html)

Scan any package: [try it](https://lazaretto.dev/#try) · [API](https://lazaretto.dev/openapi.json)

---

Machine-readable index: https://lazaretto.dev/llms.txt. OpenAPI: https://lazaretto.dev/openapi.json. MCP endpoint: https://lazaretto.dev/mcp. Any page on this site is available as markdown by adding .md to its path.