Senior Engineers working with React Native since 2016. North America-based. No outsourcing.
Upload your lockfile to see which installed packages match published security advisories. Free, no account.
Supported: package-lock.json (lockfileVersion 1, 2, or 3) and yarn.lock (Yarn Classic v1 or Yarn Berry). Not supported: package.json, pnpm-lock.yaml, Bun lockfiles, and native lockfiles such as Podfile.lock.
Drag & drop your package-lock.json or yarn.lock here
or
Before you upload: viewing the report requires your work email.
Your lockfile is parsed in your browser and the file is never uploaded. Only package names and versions are sent: to our lookup service, which checks the npm registry's advisory database, and to OSV.dev if that lookup fails. What is sent and stored · See a sample report
Checking 0 package versions against published advisories...
Walk through your results with a senior React Native engineer and decide what needs fixing first.
Not ready for a call? Read the React Native security checklist for areas this scan does not cover.
We read the exact versions your lockfile installed, direct and transitive. Packages installed from git, local folders, or workspaces are not on the npm registry, so they are counted and listed as not checked.
Versions are matched against the npm registry's advisory database, the same bulk advisory endpoint npm audit uses, whose entries link to the GitHub Advisory Database. If that lookup fails, we query OSV.dev instead.
Every report says whether the scan was complete, partial, or failed. If a lookup fails, you see an incomplete or failed scan, never a clean result.
We detect your React Native and Expo versions, tag React Native ecosystem packages, and, for lockfileVersion 2 and 3, show whether an affected package is a direct or transitive dependency.
Read the full methodology and limitations · See a sample report
Senior Engineers working with React Native since 2016. North America-based. No outsourcing.
See exactly which packages have known vulnerabilities and their severity levels.
Walk through your results with a React Native engineer. 30 minutes, no pitch.
We handle the upgrades while your team stays focused on building features.
package-lock.json with lockfileVersion 1, 2, or 3, and yarn.lock from Yarn Classic (v1) or Yarn Berry. It does not read package.json, because that file lists version ranges rather than installed versions. It also does not read pnpm-lock.yaml, Bun lockfiles, or native lockfiles such as Podfile.lock. For pnpm or Bun projects, npm install --package-lock-only creates a package-lock.json, though its resolved versions can differ slightly from what pnpm or Bun installed.
No. The file is parsed in your browser. Package names and versions, plus the detected React Native version, are sent to our Cloudflare Worker, which checks them against the npm registry's advisory database. If that fails, your browser sends the names and versions to OSV.dev. When you open the report, your email and a scan summary are sent to us so we can follow up. The lockfile itself and your full package list are not stored. When scan storage is enabled on our Worker, a scan that matched advisories is saved at lookup time, before you enter an email: its matched advisories, counts, React Native version, and basic request details (country, browser user agent, referring page), kept for up to 90 days. See how the scanner works.
The primary lookup uses the same npm registry bulk advisory endpoint as npm audit, so matches should agree. The differences: you only need the lockfile, each advisory is listed once per package instead of once per install path, and the scanner does not compute fixes, flag packages that depend on vulnerable versions, or separate dev-only dependencies. Run npm audit in the project for those.
It means every registry package version in your lockfile was checked and none matched a published security advisory at the time of the scan. It does not mean the app is secure. Advisories only cover publicly reported vulnerabilities in npm packages, and the scan does not look at your source code, native iOS or Android dependencies, configuration, secrets, or whether your app uses the affected code.
A partial scan means some lookups failed. The report says how many package versions were checked and shows matches for those only. A failed scan means nothing could be checked, so no results are shown and no email is requested. Neither is a clean result. Try again later, or run npm audit locally.
Yes, if the project has a package-lock.json or yarn.lock. The scanner checks the JavaScript packages in it, including Expo packages, and shows the Expo and React Native versions it finds. Native code generated by prebuild and config plugins is not checked.
Book a free 30-minute call with a senior React Native engineer. We'll walk through your results and tell you exactly what it takes to remediate them.
Book a Free Call →