Is anything in your lockfile under attack?

Paste a lockfile or a list of GitHub Actions. Exact versions are matched against OSV, and only packages with active threats are shown: malware, compromised releases and exploited vulnerabilities. Your file is checked in memory and not stored.

Results appear here. Older advisories with no sign of active attacks are left out on purpose.

From the command line

curl -sf --data-binary @package-lock.json \
  "https://compromised.live/api/v1/check?filename=package-lock.json"

From an agent

MCP  https://compromised.live/mcp
tool check_dependencies
     packages: [{ ecosystem, name, version }]

In GitHub Actions: fail the build on active threats

# .github/workflows/compromised.yml
name: Active threat check
on: [push, pull_request]
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4   # pin to a full commit SHA
      - name: Check dependencies against active threats
        run: |
          curl -sf --data-binary @package-lock.json \
            "https://compromised.live/api/v1/check?filename=package-lock.json" > result.json
          jq '.matches[] | "\(.name)@\(.version): \(.title) (\(.threat_id))"' result.json
          jq -e '.matches | length == 0' result.json > /dev/null