JSPM

  • ESM via JSPM
  • ES Module Entrypoint
  • Export Map
  • Keywords
  • License
  • Repository URL
  • TypeScript Types
  • README
  • Created
  • Published
  • Downloads 32
  • Score
    100M100P100Q85832F
  • License Apache-2.0

Check your npm packages against a curated list of known-compromised versions. Built for the AI-coding era.

Package Exports

    This package does not declare an exports field, so the exports above have been automatically detected and optimized by JSPM instead. If any package subpath is missing, it is recommended to post an issue to the original package (sandcheck) to support the "exports" field. If that is not possible, create a JSPM override to customize the exports field for this package.

    Readme

    sandcheck

    Check your npm packages against a curated list of known-compromised versions. Built for the AI-coding era.

    This is the CLI package. The published binary is sandcheck.

    Status

    Placeholder release. The CLI currently prints a "coming soon" message — it does not yet scan lockfiles. See the repository README for project status, roadmap, and the data-source policy.

    Intended usage (not yet functional)

    # Scan the lockfile in the current directory
npx sandcheck

# Or install globally
pnpm add -g sandcheck
sandcheck

    Security posture

    This package ships with no install-time lifecycle scripts (preinstall, install, postinstall). Installing sandcheck cannot execute arbitrary code from the package.

    Releases are published with npm provenance via GitHub Actions OIDC trusted publishing. Look for the green "Provenance" badge next to the version on the npm package page — it appears on every release from 0.0.2 onward. The initial 0.0.1 release was published manually to claim the package name and is unsigned; do not rely on it.

    License

    Licensed under Apache License 2.0. The Sandcheck dataset (distributed separately) is licensed under CC-BY-4.0.