---
title: "Free lockfile malware check for npm, yarn and pnpm. Lazaretto"
description: "Upload a package-lock.json, yarn.lock or pnpm-lock.yaml and match every exactly pinned version against published malicious-package advisories. Free, no account."
url: "https://lazaretto.dev/check/lockfile"
---

[Home](https://lazaretto.dev/) / Check a lockfile

Free check

# Check your lockfile for known malware

Your lockfile names the exact version of each package you install, even the ones you never picked. Upload it and we match each version against published malware lists. Nothing is installed or run, and the file is not stored.

## Upload a lockfile

Form: `POST https://lazaretto.dev/check/upload` as multipart/form-data with `lockfile`.

package-lock.json, yarn.lock or pnpm-lock.yaml. Free, no account. The file is not stored.

## Or from a terminal

```sh
curl -s https://lazaretto.dev/check --data-binary @package-lock.json
```

Also reads `npm-shrinkwrap.json`, `yarn.lock` and `pnpm-lock.yaml`. No key.

## What this check reads

**It reads**

The name and exact version of each pinned package. We match them against OSV and OpenSSF malware lists.

**It does not read**

The code. It cannot see a bad release nobody has reported yet. So no match makes no promise that a package is free of risk.

**What a match means**

We name the package, the version and the advisory. You can remove or upgrade it before you install.

**Why exact versions**

A range like `^5.0.0` has no clear answer, since a bad release can sit between clean ones.

[Where the lists come from](https://lazaretto.dev/sources). [How to tell if an npm package is malicious](https://lazaretto.dev/blog/how-to-tell-if-an-npm-package-is-malicious).

## Run it on every pull request

A bad release can look like any other version bump. Add this file as `.github/workflows/lazaretto.yml` and each pull request gets this check, with the result as a comment. Free, no key.

```yaml
name: Lazaretto
on: [pull_request]
permissions:
  contents: read
  pull-requests: write
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: jamesdfinance-dev/lazaretto-scan-action@v2
```

## From your agent

The same check is the `check_lockfile` tool on our [MCP server](https://lazaretto.dev/mcp). No key. [Setup for every client](https://lazaretto.dev/add). To read a package's code, see [the developer guide](https://lazaretto.dev/developers).

---

Machine-readable index: https://lazaretto.dev/llms.txt. OpenAPI: https://lazaretto.dev/openapi.json. MCP endpoint: https://lazaretto.dev/mcp. Any page on this site is available as markdown by adding .md to its path.