Project scanner

Scan any GitHub repo.
See every risk.

Enter a repo URL or paste a dependency file. Scores every dependency on behavioral signals — publisher depth, release consistency, project longevity. Flags the packages that match real supply chain attack profiles.

Prefers lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) for transitive deps; falls back to package.json, requirements.txt, Cargo.toml, go.mod. Monorepos: paste the subdirectory URL. Public repos only. How scores work →

or paste a dependency file directly

Scans dependencies + devDependencies. No data stored. How scores work →