Package Stoplight
Before you install it, check it. Type one package name, or paste your package.json, and get a green, amber or red light for each dependency.
How to read the lights
Green: nothing alarming found. This is not a guarantee, only that the checks below came back clean.
Amber: look closer. Something is thin or unusual, such as a young package, few maintainers or a check that could not run.
Red: do not install yet. The name looks like a typosquat, has known vulnerabilities, or the package was not found.
Checks use public registry data and the OSV vulnerability database. Build provenance is shown but never raises the light: attackers who take over a maintainer account can publish properly signed releases.
Want the full report with every signal? Try the Package Scanner.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.