Skip to content
MicroENV

Package Check

Check an npm or PyPI package for malware before you install it.

Price
Free in beta
Typical time
about 1 minute

Malicious packages steal tokens and SSH keys the moment you run npm install or pip install, often through look-alike names or names AI assistants invent. The agent downloads the exact package from the official registry, reads its code, and runs its install and import code in a sealed sandbox without internet, watching every file and network access.

Start a job

The result appears on the next page and in your inbox, usually in about 1 minute.

Registry

We send the result link here. No newsletter, no account needed.

By starting you agree to the terms. Files are deleted after 7 days.

Example result

Sample data

Verdict

Dangerous

Don't install colorsjs 1.0.3: its postinstall script reads your SSH keys and tries to upload them.

Why

  • Tried to reach the internet while npm postinstall script — Blocked by the sandbox: 185.x.x.x:443 (blocked)
  • Touched credential files while npm postinstall script — /work/.ssh/id_rsa, /work/.npmrc
  • Name looks like the popular package “colors”
Version
1.0.3
Install scripts
1
Network attempts
2
Findings
5

Evidence 5

Every finding behind the verdict, with the fix where there is one.

  • Blocked by the sandbox: 185.x.x.x:443 (blocked)

What to do

Don't install it. If you already did, rotate your SSH keys and npm token.