EVIDENCE UNIT // NPM REGISTRY CASE #—

DEP-XRAY

supply-chain forensics for package.json — no build, no deps, no telemetry. every check runs in your browser against the public registry.

01 / INTAKE paste a package.json

02 / FINDINGS idle

—

heuristics: install scripts · fresh publishes · dormant-then-revived · typosquats · unpinned ranges · missing packages (dependency confusion) · deprecations · single-maintainer a negative scan is not a clean bill — it only means these signals are absent.