Free tool · Python & npm

Was I hit?

Paste or drop your lockfile to see whether any package version has a known vulnerability or has been flagged as malicious.

Try a sample:

Upload file

or drop a file here

Disclaimer: this is a best-effort check based on public data from OSV.dev. It can miss issues that aren’t listed yet, and it is not a security audit or guarantee. Your file never leaves your browser; only package names and versions are sent to OSV.dev. See our terms.

How it works

Private by design

1Paste or drop a lockfile

requirements.txt, poetry.lock, package-lock.json or yarn.lock.

2Parsed in your browser

Your file is never uploaded to Caldrel. Only package names and versions go to OSV.dev.

3See the results

Known vulnerabilities and malicious-package reports, with fixed versions where OSV.dev lists them.

Is my file uploaded?

No. Your file is read in your browser and never sent to Caldrel. Only package names and versions are sent to OSV.dev, Google’s open vulnerability database.

Does a clean result mean I’m safe?

Not a guarantee. It only finds issues already published in OSV.dev, and new attacks may not be listed yet.

Which formats work?

requirements.txt (exact == pins), poetry.lock, package-lock.json and yarn.lock. More formats are planned.

One short email a week

A weekly roundup of tech, AI and security news. Signups aren’t open yet. Follow @CaldrelHQ on 𝕏 to hear when they are.

Follow @CaldrelHQ on 𝕏