DEP-XRAY

Supply-chain forensics for package.json, in one HTML page.

Paste a manifest, hit RUN SCAN, and every dependency is checked live against the public npm registry for the signals that actual 2025–2026 supply-chain incidents rode in on:

• install scripts (preinstall / install / postinstall) — the worm entry point
• fresh publishes — latest version pushed within the last 7 days
• revival pattern — dormant 18+ months, then a sudden new release (hijacked-maintainer tell)
• typosquats — names one edit away from a top package (loadsh vs lodash)
• 404 packages — not on the registry at all → dependency-confusion surface
• unpinned ranges — *, latest, and floating ^/~
• brand-new packages — first published under 30 days ago
• deprecations and single-maintainer packages

Design constraints (on purpose)

• Zero dependencies. No build step, no node_modules, no framework. A tool about dependency risk should not ask you to install any.
• Nothing leaves your browser except package-name lookups to registry.npmjs.org.
• A clean scan is absence of these signals, not a security guarantee.

Run

Any static file server works:

python -m http.server 4173
# or
npx serve .

Then open http://localhost:4173. Opening index.html directly also works in browsers that allow fetch from file:// pages (most do for CORS-enabled endpoints like the npm registry).