verify

verify checks that a package is real, not malicious and reputable before you install it. It covers npm, PyPI and crates.io.

vulkro-live verify express left-pad@1.3.0
vulkro-live verify --ecosystem pypi requests flask
vulkro-live verify --manifest ./package.json
vulkro-live verify --lockfile ./package-lock.json

$ vulkro-live verify express lodahs axios-retry-helper

npm  express             OK          latest 5.2.1, 109089346 weekly downloads
npm  lodahs              MALICIOUS   flagged malicious by OSV (MAL-2025-25502): Malicious code in lodahs (npm)
npm  axios-retry-helper  MISSING     not found in the registry

3 checked: 1 OK, 1 MALICIOUS, 0 LOOKALIKE, 0 VULNERABLE, 1 MISSING, 0 SUSPICIOUS

Verdicts

A package gets the worst verdict that applies, in this order:

Verdict	Meaning
MISSING	Not in the registry, or that version was never published: likely invented by an AI
MALICIOUS	Flagged as malicious by OSV
LOOKALIKE	One typo or look-alike character away from a popular package
VULNERABLE	That version has a known advisory
SUSPICIOUS	Very new or very few downloads
OK	None of the above

Flags

Flag	Effect
--ecosystem <ECOSYSTEM>	npm (default), pypi or crates, for packages named on the command line
--manifest <file>	Read package.json, requirements.txt, pyproject.toml or Cargo.toml
--lockfile <file>	Check every locked package, plus off-registry URLs and missing integrity hashes
--min-age-days <n>	Newer than this is SUSPICIOUS (default 30)
--min-downloads <n>	Fewer downloads than this is SUSPICIOUS (default 100)
--no-cache	Skip the local cache
--format <FORMAT>	text (default), json or sarif

Exit codes: 0 all OK, 1 any package flagged, 2 error.

Only package names and versions are sent, to the public registries and OSV.dev. Responses are cached locally. To clear a package you reviewed, use trustdb.