Home / npm

Is bcrypto safe to install?

ASK DepWall stops this install and asks a human.

Checked 2026-09-20 against version 5.5.2, using the same engine the CLI runs. This is a record of one check at one moment — run the gate for the answer that applies to the version you are about to install.

What the registry says

Signals that fired

• warn install-scripts

  package runs lifecycle install scripts (preinstall/install/postinstall)

  The package runs lifecycle scripts at install time, before anything is imported.

What was checked

DepWall reads registry metadata and the package's own manifest before any of its code runs. On npm that means the name against a popularity dictionary and a curated hallucination feed, the tarball hash against OSV's malicious-release advisories, lifecycle scripts, publication age and adoption, provenance attestations across this and prior releases, and dependencies that resolve outside the registry.

It does not execute the package, and this page did not download its source. How verdicts are decided · what this cannot catch.

Check it yourself

npm i -g depwall && depwall init
depwall check bcrypto

Once depwall init has run, the check happens on npm install itself — including for the transitive dependencies you never chose, which is where most of this actually arrives.