JSPM

  • ESM via JSPM
  • ES Module Entrypoint
  • Export Map
  • Keywords
  • License
  • Repository URL
  • TypeScript Types
  • README
  • Created
  • Published
  • Downloads 32
  • Score
    100M100P100Q85813F
  • License Apache-2.0

Check your npm packages against a curated list of known-compromised versions. Scans package-lock.json, pnpm-lock.yaml, and yarn.lock. Built for the AI-coding era.

Package Exports

    This package does not declare an exports field, so the exports above have been automatically detected and optimized by JSPM instead. If any package subpath is missing, it is recommended to post an issue to the original package (sandcheck) to support the "exports" field. If that is not possible, create a JSPM override to customize the exports field for this package.

    Readme

    Sandcheck

    sandcheck

    Check your npm packages against a curated list of known-compromised versions. Built for the AI-coding era.

    This is the CLI. The published binary is sandcheck.

    Install

    # Run once without installing
npx sandcheck

# Or install globally
pnpm add -g sandcheck
sandcheck

    Commands

    sandcheck                          # scan the current directory (default)
sandcheck scan ./some/project      # explicit scan
sandcheck check chalk 5.6.1        # check a single package@version
sandcheck update                   # force-refresh the cached dataset
sandcheck --help                   # all options

    Sandcheck detects and parses any of: package-lock.json (npm v7+), pnpm-lock.yaml, or yarn.lock (classic v1 or berry).

    Useful flags

    • --json — machine-readable output
    • --quiet — only print when findings exist (CI-friendly)
    • --fail-on <severity> — critical | high | medium | low (default high)
    • --dataset <url-or-path> — pin a specific dataset snapshot
    • --no-include-dev — skip devDependencies
    • --no-color — disable terminal colors

    Exit codes

    Code Meaning
    0 Clean (no findings at or above --fail-on)
    1 Compromised packages found at or above --fail-on
    2 Invocation / lockfile error
    3 Dataset fetch or validation error

    Caching

    The dataset is cached at ~/.cache/sandcheck/compromised.json and refreshed after 1 hour. If the network is unavailable, Sandcheck falls back to the cached copy and warns you. sandcheck update forces a refresh.

    MCP server

    There is also a Model Context Protocol server, @sandcheck/mcp, so AI coding assistants (Claude Code, Cursor, Windsurf) can check packages before suggesting installs. See the project README.

    Security posture

    This package ships with no install-time lifecycle scripts (preinstall, install, postinstall). Installing sandcheck cannot execute arbitrary code from the package.

    Releases are published with npm provenance via GitHub Actions OIDC trusted publishing. Look for the green "Provenance" badge next to the version on the npm package page.

    Disclaimer

    Provided "as is", without warranty of any kind. The dataset is a best-effort aggregation and may be incomplete, lag behind newly-disclosed compromises, or contain errors propagated from upstream sources. Use Sandcheck as one signal in your supply-chain hygiene, not the only one. To the maximum extent permitted by law, the maintainers and contributors are not liable for any damages arising from use of this tool or its data. See the Apache-2.0 license for the full warranty and liability disclaimers.

    License

    Licensed under Apache License 2.0. The Sandcheck dataset (distributed separately) is licensed under CC-BY-4.0.