• Security
Check if your internal package names exist on the public npm registry. Detect dependency confusion attack vectors.
• About this tool
Check if your private package names are squatted on the public npm registry. Detect dependency confusion attack surface before attackers exploit it.
• FAQ
An attacker publishes a malicious package on the public npm registry with the same name as an internal/private package. When the package manager fetches dependencies it may prefer the public (malicious) version.
It queries the public npm registry for your package names. If a package exists publicly and you also use it internally, you may be at risk.
Scope your internal packages under an npm scope (e.g. @yourcompany/package-name), or use npm config to explicitly pin internal packages to your private registry.
This tool checks npm only. Similar attacks exist for PyPI and RubyGems — check those registries manually or use tools like safety or bundler-audit.
• Related
HTTP Security Headers Checker
Audit the HTTP security headers of any website. Score CSP, HSTS, X-Frame-Options, and more.
CDN & WAF Detector
Detect the CDN or Web Application Firewall protecting any website. Identify Cloudflare, Akamai, AWS, and more.
JWT Encoder / Decoder
Encode or decode JSON Web Tokens in your browser. Inspect header, payload, and expiry — optional HS256 signing, nothing sent to a server.
• automated security
PandaONE runs autonomous agents against your app, validates findings with proof, and opens fixes as pull requests.
Get started