Check a package before installing it
check-packageGet a supply-chain verdict for one package before adding it: known CVEs/GHSA and malware, deprecation, license, newest advisory-free version, same-line safe version, and typosquat lookalikes.
Instructions
Supply-chain verdict for one package, no docs: known advisories (CVE/GHSA, malware), deprecation, license, newest version with no known advisories, the safe version on the same release line as the one you pass, and typosquat lookalikes. For several packages use check-packages, one call for the whole list.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Package name as the registry knows it, e.g. "lodash", "requests". | |
| detail | No | Return the full JSON report (every advisory, dates, sources) instead of the summary. | |
| version | No | Version you intend to install or already use. | |
| ecosystem | Yes | npm, pypi, cargo, go, maven, nuget, rubygems or composer (aliases like "python" work). |