Scan Dependency

Check any package before installation. Get real-time security analysis from our local scanner roles.

Scanning is available without a wallet. Connecting one does not sign or submit anything on its own.

Try these examples:

Recent Scans

30 total

Package	Version	Verdict	Risk Score	Time	Open
puppeteer	latest	ALLOW	13	Oct 13	View Report
@frengki0707/google-cloud-clone	1.33.1	ERROR	—	Oct 13	View Report
@frengki0707/google-cloud-clone	1.33.1	ERROR	—	Oct 13	View Report
esbuild	latest	REVIEW	37	Oct 13	View Report
@onereach/orest-cli	latest	ALLOW	12	Oct 13	View Report
@tochka-ui/foundation	latest	ALLOW	13	Oct 13	View Report
osv-npm	latest	ERROR	—	Oct 13	View Report
sbx-mask	latest	ALLOW	0	Oct 13	View Report
conv-context-next	latest	ALLOW	0	Oct 13	View Report
node-ipc	latest	ALLOW	9	Oct 13	View Report
global	latest	ALLOW	0	Oct 13	View Report
namescout	latest	ALLOW	0	Oct 13	View Report

Scan
Inspect the published tarball, registry metadata and OSV advisories. Package code is never executed.
Decide
Three local scanner roles sign their findings; a deterministic policy returns ALLOW, REVIEW or BLOCK.
Protect
The firewall enforces that verdict before npm runs. Anchoring to Solana Devnet is optional.

npm Registry

Published packages only

Git, URLs, local paths and workspace specs are refused rather than resolved.

npm metadata & integrityRegistry record, dist-tags, published hashRegistry record, dist-tags, published hash
Published tarball inspectionReal archive contents, no executionReal archive contents, no execution
Advisory lookupOSV vulnerability records for the packageOSV vulnerability records for the package
Static pattern detectionInstall scripts and suspicious sourceInstall scripts and suspicious source
Signed scanner evidenceThree local roles, one operatorThree local roles, one operator
Deterministic verdictALLOW / REVIEW / BLOCK, no exceptionsALLOW / REVIEW / BLOCK, no exceptions
Optional Solana Devnet anchorProof bundle exported regardlessProof bundle exported regardless