Two different layers: Socket watches a connected dependency graph and the public registries on an ongoing basis across 70+ risk categories. This tool answers one narrower, one-time question from a pasted lockfile or the CLI — does this exact package version carry npm's own dist.attestations.provenance field — with no account and nothing installed.
Socket is a supply-chain security platform. Its own site describes deep package inspection that characterizes what a dependency actually does, connected through a GitHub app, a CLI, or a browser extension, and it flags more than 70 categories of risk across npm and other ecosystems — malware, typosquatting, hidden or obfuscated code, and permission creep among them — while monitoring a project's dependency graph on an ongoing basis. It is free for public, open-source use, and Socket's own site lists paid Team, Business, and Enterprise tiers for private-repository and organization use. Socket has written publicly about npm provenance and trusted publishing, so provenance is plausibly one signal folded into its broader per-package score for a connected project; this page does not claim to know exactly how Socket weighs or surfaces it, since this session cannot verify that live against Socket's own product.
This tool does none of what Socket does. It has no account, no ongoing
service, no GitHub app, and it never scores a package or a project.
Given a pasted package-lock.json, package.json,
or a plain list of package names, it makes one read-only GET request per
package to registry.npmjs.org — the same registry
npm install already talks to — and reports exactly
the dist.attestations.provenance field the registry
publishes for that version: present (published via trusted
publishing/OIDC or npm publish --provenance) or absent (a
classic, stealable long-lived token). Nothing is uploaded, nothing is
connected, and nothing is remembered between runs beyond what you paste
again next time.
| Question | Where to answer it |
|---|---|
| I want continuous, registry-aware scanning of my whole dependency graph for malware, typosquats, permission creep, and dozens of other supply-chain risks — not just publish provenance. | Socket — that is the ongoing, cross-ecosystem job it is built for. |
| I want to know right now, for free, exactly which packages in a pasted lockfile lack a provenance attestation, with no account and nothing connected. | This tool — paste it, get the list, nothing installed. |
| I want a GitHub app or CLI that watches every future pull request for newly introduced supply-chain risk. | Socket — this tool has no memory between runs and watches nothing on its own. |
I want a single, exportable report across several repositories' lockfiles with no sign-up, wired into a script with --json. | This tool's CLI — paste or point it at each lockfile in turn. |
| I want to know whether a specific package has ever shown malicious behavior, or is a typosquat of a popular name. | Socket — this tool checks one registry field and cannot answer that. |
| I want the exact registry-documented provenance field, per package version, with no interpretation or score layered on top. | This tool — that is the one fact it reports, nothing more. |
A team can reasonably run both: Socket for continuous, registry-aware defense against a live attack already under way, and this tool as a fast, zero-account, zero-install check of exactly which dependencies still publish through a stealable token — useful on its own, or before deciding whether Socket's broader connected monitoring is worth setting up at all. This page does not evaluate Socket's detection accuracy or how it weighs provenance and makes no claim about either — it only describes Socket's documented product shape and states what this tool does differently. A clean result from either one is not a guarantee that a dependency is safe: absence of a provenance attestation is a fact about how a version was published, not a verdict.
This tool needs no account and no sign-up: it is a static page that runs in your browser, or a zero-dependency Node CLI, and every check is one read-only request per package to the public npm registry.
Socket's own site describes ongoing, registry-aware monitoring of a connected dependency graph across more than 70 risk categories — through a GitHub app, CLI, or browser extension — and its own blog post on npm provenance discusses the mechanism, so provenance is plausibly one signal folded into Socket's broader scoring for a connected project. This tool does a narrower, one-off thing: given a pasted package-lock.json, package.json, or plain list, it makes one read-only GET request per package to the public npm registry and reports exactly the dist.attestations.provenance field on that version — no account, no GitHub app, no ongoing connection, and nothing installed.
They sit at different layers. Socket runs on an ongoing basis against a connected project and the public registries, watching for malware, typosquatting, permission creep, and dozens of other supply-chain risks, as a service that is free for public open-source use and offers paid Team, Business, and Enterprise tiers for private and organization use, per Socket's own site. This tool answers one narrower, one-time question with nothing to connect: for the packages in this pasted lockfile or list, which versions were published with a provenance attestation and which still rely on a classic, stealable publish token? Free, no account, no install, one read-only registry request per package.
No. This page is not affiliated with, endorsed by, or sponsored by Socket, Inc. Socket is a trademark of Socket, Inc., named here only to describe what this tool is and is not, based on Socket's own publicly documented product.
Open npm Provenance Check to check your own lockfile, or read why this exists alongside npm audit signatures.