Home / Check a lockfile
Free check
Check your lockfile for known malware
Your lockfile names the exact version of each package you install, even the ones you never picked. Upload it and we match each version against published malware lists. Nothing is installed or run, and the file is not stored.
Upload a lockfile
package-lock.json, yarn.lock or pnpm-lock.yaml. Free, no account. The file is not stored.
Or from a terminal
curl -s https://lazaretto.dev/check --data-binary @package-lock.jsonAlso reads npm-shrinkwrap.json, yarn.lock and pnpm-lock.yaml. No key.
What this check reads
The name and exact version of each pinned package. We match them against OSV and OpenSSF malware lists.
The code. It cannot see a bad release nobody has reported yet. So no match makes no promise that a package is free of risk.
We name the package, the version and the advisory. You can remove or upgrade it before you install.
A range like ^5.0.0 has no clear answer, since a bad release can sit between clean ones.
Where the lists come from. How to tell if an npm package is malicious.
Run it on every pull request
A bad release can look like any other version bump. Add this file as
.github/workflows/lazaretto.yml and each pull request gets this check, with the result as a comment. Free, no key.
name: Lazaretto
on: [pull_request]
permissions:
contents: read
pull-requests: write
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: jamesdfinance-dev/lazaretto-scan-action@v2From your agent
The same check is the check_lockfile tool on our MCP server. No key.
Setup for every client. To read a package's code, see
the developer guide.