Lockfile check · no account
Is anything in your lockfile on CISA's exploited list?
The problem
CISA keeps a list of flaws attackers are already using. Small teams rarely know whether their exact dependency versions are on it.
What it does
Reads your package-lock.json and lists every package version that matches a flaw on CISA's exploited list, with the version that fixes it.
Why it matters
These are the flaws being used against companies right now; they should be patched before anything else on your list.
How to use it
Paste your lockfile (or try the sample). No account needed. Nothing is stored, and nothing about your app is fetched or probed.