Free & open source

safecheck

The same supply-chain risk scanning that powers this website, in your terminal. Scan a single package, its full dependency tree, or your whole repo's manifests - no account, no browser, works great in CI.

View on npmView on GitHub

Install

Try it once, no install:

npx safecheck axios

Install globally, use it anywhere:

npm install -g safecheck

Or add it to a project as a dev dependency, so a security check works for anyone who clones the repo:

npm install --save-dev safecheck

Scan a package

Latest version, npm assumed:

safecheck axios

A specific version:

safecheck axios@1.2.0

A non-npm package - prefix with the ecosystem:

safecheck pypi:requests
safecheck maven:com.google.guava:guava

Include its full dependency tree:

safecheck axios --tree

Scan a whole repo

Run with no arguments inside a directory with a manifest (package.json, requirements.txt, pyproject.toml, or pom.xml) and it auto-detects and scans everything - direct and transitive dependencies, across every manifest found:

cd my-project
safecheck

Or scan a specific path from anywhere:

safecheck scan ./some-other-repo

Add it as a project script so it's one command away for anyone who clones the repo:

"scripts": { "security-check": "safecheck" }

Use it as a CI gate

Exit code 0 means safe, 1 means the worst verdict found was suspicious/investigate (or something couldn't be scanned):

safecheck || exit 1

Full reference

safecheck --help lists every option - --json for machine-readable output, --max-depth/--node-cap to tune dependency-tree exploration, --api-url to point at a self-hosted backend, and more. The full README is on GitHub.

Want dependency-tree visualization, shareable result pages, or just don't want to open a terminal? Use the full experience on the PackageSafe website.