Check a whole lockfile for known-malicious dependencies (free, no API key)
check_lockfileCheck each exactly-pinned dependency in a lockfile against published malicious-package advisories (OSV/OpenSSF) to identify known malware before installation.
Instructions
Checks every exactly-pinned dependency in a lockfile against published malicious-package advisories (OSV / OpenSSF). One call covers the entire dependency tree.
WHEN TO USE: before installing dependencies, or when auditing a project you did not write. This is the broadest and cheapest check, so start here. Prefer scan_artifact when you need to know what a specific package DOES rather than whether it is already known malware. Prefer known_bad_lookup when you already hold a sha256 of a file rather than a lockfile.
COST AND EFFECTS: free, no API key, no payment. Read-only. Reads the lockfile from the working directory itself, so a large lockfile never has to be pasted through the model context.
LIMITS: only exactly-pinned versions can be answered. A range such as ^5.0.0 has no definitive
answer, because a compromised release usually sits between clean ones (chalk 5.6.1 was malware
while 5.3.0 and later releases were not). Entries with no published registry identity
(file:, link:, workspace:, git) are counted under skipped rather than silently dropped.
READING THE RESULT: malicious lists confirmed known-malware versions with advisory ids.
An empty malicious list is an all-clear ONLY when unverified is also empty: anything under
unverified could not be checked and must never be reported as clean.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Lockfile path relative to the working directory, e.g. "package-lock.json" or "apps/web/pnpm-lock.yaml". Omit to auto-detect package-lock.json, npm-shrinkwrap.json, yarn.lock, or pnpm-lock.yaml in the working directory. Only those filenames are read. | |
| lockfile | No | Full text contents of a lockfile, for when it is not on disk (for example fetched from a PR diff). Supplying this skips reading from disk. Prefer omitting it and letting the tool read the file, which keeps a large lockfile out of the context window. |