lockspect 1.0.1

v1.0.1

lockspect 1.0.1

lockspect 1.0.0

First release of lockspect: drop a lockfile and see malware, known vulnerabilities, too-fresh releases, versions missing from npm, install scripts and licence risk, in your browser, terminal or CI.

Try it: https://feresbr1.github.io/lockspect/ (click a lockfile hit by the axios compromise for a real detection)

Highlights

• Parses package-lock.json / npm-shrinkwrap.json (v1–v3), pnpm-lock.yaml (5.x, 6.x, 9.x), Yarn classic and Berry yarn.lock, and bun.lock
• Malware (MAL-*) and GHSA/CVE advisories from OSV.dev, with the version that fixes them
• Publish age vs. a configurable cooldown, unpublished versions, deprecation, licences and provenance from deps.dev and the npm registry
• Copy-paste release-cooldown config for npm, pnpm, Yarn, Bun, Renovate and Dependabot
• Markdown and JSON export

CLI

lockspect.mjs below is a single file with no dependencies (Node.js 18.17+):

npx github:feresbr1/lockspect --fail-on malware,vuln:critical
# or
curl -LO https://github.com/feresbr1/lockspect/releases/download/v1.0.0/lockspect.mjs
node lockspect.mjs path/to/pnpm-lock.yaml

GitHub Action

- uses: feresbr1/lockspect@v1
  with:
    fail-on: malware,vuln:critical