Skip to content
Solvex Space

Cybersecurity · free, no signup

Dependency Manifest Analyzer

Paste a package.json, package-lock.json or requirements.txt and see what installing it does. `npm install` is not a download, it is code execution: a package can declare preinstall, install, postinstall or prepare scripts and npm runs them automatically, in the installing shell, with that shell’s environment — the SSH agent and cloud credentials on a laptop, whatever secrets the job holds in CI. Nothing has to be imported and no code has to be reached at runtime; the install is the whole event. Also covers dependencies that bypass the registry — a git branch reference installs different code tomorrow with nothing in the file changed — unconstrained versions, lockfile entries with no integrity hash, and names sitting one edit from a very popular package, counting transpositions as one edit because that is how squats are spelled. That last one is reported as a prompt to check and never as an accusation: nothing is resolved, so who publishes a package is unknown, and being wrong about a real package is the worse error. No registry and no advisory database is contacted.

Authorized, defensive use only. Check assets you own or lawfully public data. This tool is educational and never provides another party's private data.

Paste a package.json, package-lock.json or requirements.txt and see what installing it does. npm install is not a download — it is code execution. A package can declare postinstall and npm runs it automatically, in your shell, with your environment: the SSH agent and cloud credentials on a laptop, whatever secrets the job holds in CI. Nothing has to be imported and no code has to be reached at runtime.

Nothing is resolved or looked up. No registry, no advisory database — so a dependency with a published critical CVE looks identical to one without, and this is not a vulnerability audit. Names close to a popular package are reported as a prompt to check, never as an accusation.

package.json, package-lock.json, or requirements.txt.

What happens to what you enter

  • The analysis runs on Solvex servers. What is recorded afterwards is a SHA-256 hash of your input and a coarse summary of the outcome — never the input itself, and never a result you could be identified from.
  • Tools that read public sources (certificate logs, DNS, a public chain) contact those sources from our servers through a fetcher that refuses private and internal addresses.
  • An email address is stored only where a tool offers to send you a report and you choose to give one.

Limits: ten runs of this tool per minute from one address, and three signed reports per minute. Past that the tool says so and tells you when to try again.

When a free check is not enough

This tool reads what is public and reports what it can see. The Secure Source Code Review engagement is the authorized, specialist-led version: signed scope, findings proven by hand, a signed report, and a retest.

Explore Secure Source Code Review
Dependency Manifest Analyzer — Solvex Space