Home / npm

npm package checks

DepWall's recorded check for 3,213 popular npm packages — the verdict its engine returns, the signals behind it, and what a quiet result does not prove.

How these were produced

Each page records what DepWall's own engine returned when it was run against live registry metadata for that package — the same evaluate() the CLI calls, not a separate scoring system built for the website. Every page carries the date and the exact version it checked.

Scoped packages (@scope/name) are not covered here. npm publishes no bulk download counts for them, and DepWall treats an unverifiable download count as grounds to ask rather than to allow — so including them would mean publishing thousands of pages describing npm's API rather than this gate. The CLI has no such limit: run it against any scoped package and it resolves normally.

A quiet result is not a safety certificate. It records that the listed checks did not fire on one version at one moment. Packages change; the classes DepWall does not claim to detect — maintainer compromise chief among them — leave every structural signal green. Treat these pages as a starting point and run the gate for a live answer.

Packages that did not come back quiet

32 of the checked packages returned something other than ALLOW. These are the pages worth reading first.

• aberlaas-lint ASK
• arib-b25-stream-test ASK
• bcrypto ASK
• deasync ASK
• eslint-config-uphold ASK
• extension-fs ASK
• fs-ext ASK
• fs-ext-extra-prebuilt ASK
• fs-extended-attributes ASK
• fs-web ASK
• gdal-async ASK
• git-commit-msg-linter ASK
• hasura-cli ASK
• mongodb-memory-server ASK
• opencv-build ASK
• parse-server ASK
• reactstrap-date-picker ASK
• redis-memory-server ASK
• rsbuild-plugin-lint ASK
• scrypt ASK
• snyk ASK
• ssh2 ASK
• stream-chat ASK
• tree-sitter-cli ASK
• tree-sitter-css ASK
• tree-sitter-json ASK
• vue-composable ASK
• vue-demi ASK
• vue-ls ASK
• vue-types ASK
• xhs-mp-shared-fs ASK
• zego-express-engine-webrtc ASK

Browse all 3,213

Every checked package, alphabetically: start at page 1.

To check a package that is not here, run the gate locally — it works on any package, not only the ones on this site.

npm i -g depwall && depwall init