← Plumbline

Check your own lockfile

Is a poisoned package version anywhere in your project, and how does it get in? Your lockfile is loaded into its own FalkorDB graph, the graph is queried, and the answer comes back with the path. It always checks the keyv / @cacheable release of 4 August 2026, and you can add any versions of your own below. It is not a general vulnerability scanner: it checks only the versions named here. Deleted after 30 minutes. Up to three checks per visitor. Nothing is installed or run.

What can I upload?
  • A package-lock.json (or npm-shrinkwrap.json) written by npm 7 or newer, i.e. "lockfileVersion": 2 or 3. This is the file npm creates next to package.json after npm install.
  • Plain JSON, up to 4 MB, 8,000 packages and 20,000 dependency links (real projects are well under half of that). You can also list package versions to check beyond the incident.
  • Not supported: yarn.lock, pnpm-lock.yaml, and old v1 lockfiles from npm 6. For a v1 file, run npm install --package-lock-only with a recent npm to regenerate it.
  • A lockfile is a list of exact versions, so it contains no secrets. Still, only paste projects you are happy to analyse.
Also check specific package versions (optional)

One per line, as package@version, for example left-pad@1.3.0 or @scope/name@2.0.1. Up to 10. They are added to your graph as an advisory and judged the same way.