Paste your lockfile. See what’s malicious — in seconds.

PkgRadar statically scans every new npm and PyPI release as it’s published — we never run the package’s code. On our public benchmark we’ve flagged the majority of recent supply-chain attacks before they landed in a public advisory. See the measured accuracy and how detection works.

This check reads only the package names and pinned versions in the file you paste. It returns verdict labels only — the full findings and indicators for a flagged package live on its package page.

A one-off check is a start. To catch the next bad release the moment it ships:

• Install-time firewall — gate every npm install / pip install on the laptop and in CI, before install hooks run.
• GitHub App — block malicious dependencies in pull requests automatically.
• MCP server — let your AI coding assistant check a package before it adds it.