Is My Site Secure

Free check

Is your website loading a hijacked JavaScript package?

Attackers increasingly hijack popular npm packages and publish poisoned versions. This check finds the packages your live site actually loads and looks each exact version up in public malware and vulnerability databases, right now.

Why it matters

When a package your site loads in the browser is hijacked, the attacker's code runs for every visitor: it can steal logins and payment details, redirect users or drain crypto wallets. You don't have to have made a mistake; updating at the wrong moment is enough.

Most tools that catch this scan your source code or lockfile. This one looks at the site your visitors actually get, so it also catches packages loaded from CDNs and old copies nobody remembers adding.

What this check looks at

  • JavaScript libraries loaded from unpkg, jsDelivr, cdnjs, Google's CDN, code.jquery.com and esm.sh, with their exact versions
  • Version banners inside your own JavaScript files (jQuery, Bootstrap, Lodash, Vue, Moment and others)
  • Each version looked up live in OSV.dev, which includes the OpenSSF malicious-packages database and GitHub advisories
  • Our synced feed of npm malware advisories from the last 48 hours, and indicators from incidents on our tracker

How to fix it

Pin and verify CDN scripts 
<!-- Pin an exact version and add Subresource Integrity, so a changed file is refused -->
<script
  src="https://cdn.jsdelivr.net/npm/example-lib@1.2.3/dist/example.min.js"
  integrity="sha384-REPLACE_WITH_HASH"
  crossorigin="anonymous"></script>

<!-- Get the hash with: -->
<!-- curl -s URL | openssl dgst -sha384 -binary | openssl base64 -A -->
npm projects 
# See what's installed and flagged
npm audit

# Upgrade a vulnerable package to a fixed version
npm install example-lib@latest

# Install exactly what the lockfile says in CI (no surprise upgrades)
npm ci
If a malicious version shipped 
1. Remove or downgrade the package and redeploy immediately.
2. Rotate API keys, tokens and secrets the affected pages could reach.
3. Invalidate user sessions if login pages loaded the package.
4. Check build machines and CI too: many hijacked packages also run at install time.

Questions

Can this see packages that only run on my server?

No. An outside check only sees code that reaches the browser. Packages used on your server, in build tools or in CI need a dependency scanner such as npm audit or pip-audit run against your code.

How current is the malware data?

Package versions are looked up live in OSV.dev at the moment you run the check. Our feed of npm malware advisories re-syncs every six hours, and the incident tracker shows when it was last updated.

My bundle is minified. Can you still detect versions?

Often, yes: many libraries keep a licence banner with their version even when minified. Bundled code without banners can't be identified reliably, so the check reports only what it can confirm.