Dependency placement
Finds packages duplicated between runtime and development sections.
Loading…
Supply-chain review
Analysis runs in this browser. No public result URL is generated, and exported reports omit the analyzed source.
Coverage
Finds packages duplicated between runtime and development sections.
Flags wildcard, dist-tag, URL, GitHub and file sources that need stronger pinning and review.
Surfaces lifecycle scripts and obvious destructive or remote-execution patterns.
Reviews React pairing, engines and packageManager fields without guessing resolved versions.
Transparent scoring
FAQ
No. It analyzes the supplied package.json in the browser and makes no registry or network request.
No. Full resolution needs the package manager, lockfile, peer dependency graph, operating system and target runtime.
preinstall, install, postinstall and prepare can execute during package installation. They require focused review even when legitimate.
Not always. The right policy depends on whether you publish a library or deploy an application. Use intentional semver ranges plus a committed lockfile and controlled updates.