Scan Dependency

Check any package before installation. Get real-time security analysis from our local scanner roles.

Scanning is available without a wallet. Connecting one does not sign or submit anything on its own.

Try these examples:

Recent Scans

13 total

Package	Version	Verdict	Risk Score	Time	Open
chalk	latest	ALLOW	0	Oct 12	View Report
is-odd	latest	ALLOW	0	Oct 12	View Report
nanoid	latest	ALLOW	0	Oct 12	View Report
lodash	latest	REVIEW	24	Oct 12	View Report
is-number	latest	ALLOW	0	Oct 12	View Report
event-stream	3.3.6	ERROR	—	Oct 12	View Report
event-stream	3.3.6	ERROR	—	Oct 12	View Report
event-stream	3.3.6	ERROR	—	Oct 12	View Report
event-stream	3.3.6	ERROR	—	Oct 12	View Report
event-stream	3.3.6	ERROR	—	Oct 12	View Report
event-stream	3.3.6	ERROR	—	Oct 12	View Report
event-stream	3.3.6	ERROR	—	Oct 12	View Report

Scan
Inspect the published tarball, registry metadata and OSV advisories. Package code is never executed.
Decide
Three local scanner roles sign their findings; a deterministic policy returns ALLOW, REVIEW or BLOCK.
Protect
The firewall enforces that verdict before npm runs. Anchoring to Solana Devnet is optional.

npm Registry

Published packages only

Git, URLs, local paths and workspace specs are refused rather than resolved.

npm metadata & integrityRegistry record, dist-tags, published hashRegistry record, dist-tags, published hash
Published tarball inspectionReal archive contents, no executionReal archive contents, no execution
Advisory lookupOSV vulnerability records for the packageOSV vulnerability records for the package
Static pattern detectionInstall scripts and suspicious sourceInstall scripts and suspicious source
Signed scanner evidenceThree local roles, one operatorThree local roles, one operator
Deterministic verdictALLOW / REVIEW / BLOCK, no exceptionsALLOW / REVIEW / BLOCK, no exceptions
Optional Solana Devnet anchorProof bundle exported regardlessProof bundle exported regardless