How much malware is in your node_modules?
A free npm malware check. Paste your package.json or lockfile and every dependency is checked for malware and known vulnerabilities against live advisory data. No account. Nothing stored.
Read-only. Your manifest is never stored or logged.
Check package.json for vulnerabilities — and for malware
The scanner reads the file you paste, walks every dependency it lists, and looks each version up against the same advisory feed that powers the Install Safe registry proxy.
Live OSV.dev advisories
Every version is looked up on OSV.dev, the open-source aggregator that combines the GitHub Advisory Database — the data behind npm audit — with the OpenSSF malicious-packages feed. CVEs and confirmed malware, updated continuously.
Severities and fix versions
Findings come back ranked from critical to low, each with its advisory ID and the first safe version to move to — so you know what to fix first and exactly what to fix it with.
Manifests and lockfiles
Paste a package.json, package-lock.json, pnpm-lock.yaml or bun.lock. Lockfiles give the most accurate picture: they pin the exact versions you install, transitive dependencies included.
How to run an npm malware check
Three steps, under a minute, no tooling to install. The same data the registry proxy enforces at install time, applied to what you already have.
- 01
Paste your package.json or lockfile
Paste package.json, package-lock.json, pnpm-lock.yaml or bun.lock into the scanner above. A lockfile is better: it pins the exact versions you install, transitive dependencies included.
- 02
Read the findings
Each flagged version shows its severity, the advisory ID and the first fixed version. Malware advisories are labelled as such — treat those as urgent, not as a backlog item.
- 03
Upgrade, or remove
Move vulnerable packages to the fixed version and reinstall. Remove malware outright and rotate any credentials that machine could reach. Then point npm at Install Safe so the next bad version never installs at all.
No account. Your manifest never leaves the scan.
Reading your results costs nothing and asks for nothing — no sign-up, no email gate, no “your report is ready, enter your work address” dance. Paste a file, read the results, close the tab.
Your dependency list is parsed to run the scan and discarded once the response is sent. We don't store your manifest, build a profile from it, or share it with anyone.
If you choose to share a report — and only then — we store the findings behind an unguessable link: package names, versions, advisory IDs, severities and counts, plus how many times the link has been opened. Never the package.json or lockfile you pasted. Shared links expire after 7 days, and support@installsafe.io will delete one sooner on request. The email address you give us is kept separately, on our contact list, so we can reach you about Install Safe — it is not deleted along with the link, and we keep it only until you ask us to remove it. Email support@installsafe.io and we will.
Why free? Because the scan runs on the same live advisory data as our paid registry proxy — and showing you what's already in your tree is the fastest way to show why blocking bad versions before they land matters.
A scan is a snapshot. Attacks are continuous.
A clean result means your dependencies are clean right now. The next compromised release can change that long before your next scan.
Install Safe is a drop-in npm registry proxy that strips malicious and vulnerable versions from the registry itself — so the next npm install can't pull them: on your machine, in CI, or from an AI agent. One config line, no workflow changes.
Before you paste
Something else on your mind? support@installsafe.io
01Is npm safe to use?
Mostly, with one caveat: npm does not review packages before they are published, so malware reaches the registry regularly — typosquats, hijacked maintainer accounts, compromised build pipelines. Installing a well-known package at a pinned version is low risk. Installing whatever a tutorial or an AI agent suggests is not. Check first, or filter at install time.
02How do I check an npm package for malware?
For a whole project, paste your package.json or lockfile above — every version is checked against the OpenSSF malicious-packages feed and CVE advisories. For a single package, look up its name on osv.dev, check its publish date and maintainer on npmjs.com, and be suspicious of a name one letter off a popular package.
03What is the difference between npm audit and an npm malware check?
Data and scope. npm audit reads the GitHub Advisory Database — CVEs, not malware. This check uses OSV.dev, which adds the OpenSSF malicious-packages feed, so confirmed malware shows up here and not there. npm audit also walks your installed tree; a package.json scan covers direct dependencies, so paste a lockfile to cover transitive ones.
04Where does the scanner get its vulnerability data?
From OSV.dev — the open-source aggregator that combines the GitHub Advisory Database with the OpenSSF malicious-packages feed. The scanner queries it live, so new advisories show up here within hours of disclosure, not on the next release cycle.
05Is my package.json uploaded or stored anywhere?
No. Your file is sent over HTTPS so the scan can run, parsed in memory, and discarded once the response is sent. If you choose to share a report, only the findings — package names, versions, advisory IDs, severities — are stored behind an unguessable link for 7 days. The file itself is never stored, whether you share or not.
06What happens when I share a report?
Sharing is opt-in; scans are otherwise ephemeral. Creating a link stores that scan’s findings behind an unguessable URL that is not indexed and expires after 7 days. The email you provide goes on our contact list and outlives the link. Email support@installsafe.io to delete either one early.
07A package was flagged — what should I do?
Start with the severity and the fixed version shown on the finding. If a fix exists, upgrade to it and reinstall. If the advisory is malware, remove the package immediately and rotate any credentials the affected machine had access to — stealing tokens is what most npm malware is for.
08Should I scan package.json or my lockfile?
The lockfile, when you have one. It records the exact resolved version of every package — including transitive dependencies — which is what actually ends up in node_modules. A package.json scan is still a useful quick check of your direct dependencies.
09Is it really free?
Yes — no account, no trial clock, no gated report. Every finding is visible to anyone who pastes a file; the only thing that asks for an email is creating a shareable link, which is optional. What we sell is the registry proxy: the thing that blocks these versions at install time instead of reporting them afterwards.