Who's There?

About

A free browser-based tool that reads an npm lockfile and lists every person who can publish code into a project's dependencies. It flags takeover risks such as maintainer email domains anyone can buy, new maintainers, releases that skip CI and code that runs on install. Scanning needs no account; Google sign-in is optional for saving and watching projects.