Resolve what you actually ship
Read supported lockfiles and exact dependency pins. Unresolved versions remain visible coverage gaps.
Check before you ship.
Security checks you can inspect.
Release decisions you can explain.
Dependency checks for your terminal, app and AI agent.
Open source · MIT licensed · built by HeySalad
Exact versions, traceable sources.Rules set the verdict.Your code is never executed by the scanner.
From a lockfile
to a decision.
Small enough to understand.
Useful wherever you ship.
Inspect the evidence
OSV matches include package versions, advisory links and retrieval dates. Verified findings survive partial lookup failures.
Make a deliberate release decision
High-severity findings block. Incomplete checks never become a clean pass. Review the report before changing dependencies.
One scanner.
Your workflow.
Use the CLI, TypeScript library or MCP server. Every result includes evidence.
Explore developer toolsTypeScript@heysalad/shiptested
import { readFile } from 'node:fs/promises';
import { scan } from '@heysalad/shiptested';
const report = await scan({
filename: 'package-lock.json',
lockfile: await readFile('package-lock.json', 'utf8'),
});
console.log(report.status);
console.log(report.findings);POWERED BY
Nemotron 3 Super
Token Factory
Search API
Advisory data from OSV.dev
Confidence comes
with boundaries.
See findings and coverage gaps. Dependency matches do not prove exploitability.
Optional Nemotron and Tavily context cannot remove findings or change verdicts.
Inspect the source