Togoder security
New scan

How-to

How to scan package-lock.json for malware

To scan a package-lock.json for malicious packages, first run npm audit (free, catches reported malware), then upload the lockfile to a source-review scanner such as Togoder Security, which downloads every locked version and has an AI model read each file. Both together cover reported and unreported malware. The same steps work for yarn.lock, pnpm-lock.yaml and bun.lock.

How-to2 min readUpdated By Togoder Security

Key takeaways

  • The lockfile lists every transitive dependency at an exact version, so scanning it covers the whole tree, not just what is in package.json.
  • npm audit and OSV-Scanner check those versions against advisories; they are free and fast but only know reported malware.
  • Uploading the lockfile to Togoder Security reviews the source of every package; the quote is free and cached files cost nothing.
  • A package the scanner could not analyze is reported as failed, never as safe.
  • Run the scan whenever the lockfile changes, for example in CI on pull requests.

Why scan the lockfile

package.json lists your direct dependencies as version ranges. package-lock.json lists what is actually installed: every transitive dependency at an exact version, with its integrity hash. A typical web app has hundreds to a few thousand entries there, and malware usually arrives through one you never chose directly. Scanning the lockfile scans what npm ci will install.

Step 1: Check reported malware for free

npm audit
# or, for any lockfile format
osv-scanner --lockfile=package-lock.json

Both match the locked versions against advisory databases that include malicious-package reports. Fix or remove anything flagged. A clean result means nothing reported, not nothing malicious.

Step 2: Find what will run at install time

package-lock.json marks every package with an install script. List them:

jq -r '.packages | to_entries[] | select(.value.hasInstallScript) | .key' package-lock.json

Those packages run code the moment you install. Review them first; see how to detect malicious postinstall scripts.

Step 3: Upload the lockfile for a source review

Open the scanner and drop the file in, or use the API:

curl -X POST https://security.togoder.click/api/paid-scan \
  -H "Authorization: Bearer $NPM_SCANNER_KEY" \
  -F "file=@package-lock.json"

Scanning new code needs a prepaid balance (top-ups from $20) or a monthly plan (from $30/month) and an API key from your account page, sent as Authorization: Bearer <key>. If every file was scanned before, you get the results straight away for free, key or no key. Otherwise only the new files count against your balance or plan, and the quote on the scan page, or POST /api/quotes, shows how many that is for free. Every package is downloaded from the registry and read, never executed.

Step 4: Read the results

  • results[].riskLevel is safe, low, medium, high, critical or failed. Treat failed as unknown.
  • Each issue has a severity, file, line, code snippet, recommendation and a stable findingId.
  • Critical findings describe dangerous behavior such as install-time network calls with your environment variables. Read the flagged lines yourself before deciding.
  • After review, add accepted findings to an ignore list (.npm-scanner-ignore format) and send it with later scans so only new findings show up.

Step 5: Repeat when the lockfile changes

Malicious versions arrive with updates. Run the scan in CI when package-lock.json changes; because results are cached per file, later scans only count code that changed. See scanning your lockfile in CI.

Other lockfiles

The same flow accepts npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml and bun.lock (convert the binary bun.lockb with bun install --save-text-lockfile --frozen-lockfile --lockfile-only), and lockfiles for Python, Rust, Go, Ruby and PHP.

Frequently asked questions

How do I scan my package-lock.json for malicious packages?

Run npm audit or OSV-Scanner for reported malware, then upload package-lock.json at https://security.togoder.click/scan (or POST it to /api/paid-scan with an API key) for an AI review of every locked package's source. The quote is free and only files nobody has scanned before count against a prepaid balance or monthly plan.

Do I need to run npm install first?

No, and it is safer not to: npm install runs install scripts. The scanner reads the lockfile and downloads the packages itself without executing them.

Does it work with yarn.lock and pnpm-lock.yaml?

Yes, as well as npm-shrinkwrap.json, bun.lock and package.json.