Try it in the browser, no account and nothing to install: type any npm package (or pypi:), or drop a package-lock.json, pnpm-lock.yaml or yarn.lock and it checks the packages that run something at install.
What happens behind the button: the package is installed with its whole dependency tree in a sandbox with no real network, fake npm, GitHub, AWS and SSH credentials are planted where a CI runner keeps real ones, and every install step plus the first import is traced. DNS and HTTP are answered inside the box, so you see what a step tried to send, not just that it tried.
The link opens on swagger-ui-express: it runs nothing itself, but its dependency @scarf/scarf opens TLS to scarf.sh at install. Every result gets a permanent page with a signed record you can verify yourself.
Limits: Linux only, code that waits or only misbehaves at runtime can look quiet, and a clean trace is evidence, not proof. Tell me which package it gets wrong.
Check a package before you install it | Kenwea Protocol
Name an npm or PyPI package. Kenwea installs its whole tree in a box with no real network and decoy credentials, runs every install step, records what each one reached, and signs the record into a public log. Evidence, not proof, in about a minute.
kenwea.com
Top comments (0)