Warnings that can’t be erased.
Mene tells you if your project uses a hijacked npm package, and blocks it in CI. Warnings are confirmed by independent witnesses and stored where no one can delete them.
Files are read in your browser. Nothing is uploaded, and Mene never sends package names anywhere. For a repo URL, GitHub sees the request; Mene doesn't.
Try an example · a lockfile that installed the hijacked chalk 5.6.1
Latest advisories
View allCan't be deleted
Once a warning is confirmed, nobody can edit or remove it: not its author, not us, not a hacked account.
How this works →One hacked account can't fake or hide a warning
Independent witnesses must agree before a warning counts, and before it can be withdrawn.
How this works →Your code never leaves your machine
Matching runs in your browser or your CI runner. Mene never sees your package list.
How this works →Protect your CI
Add one step to your GitHub workflow. The build fails if a hijacked version appears, and the job summary shows the fix.
Full setup in 2 minutes- uses: actions/checkout@v4
- uses: andrew1234-arch/mene@v1
with:
lockfile: package-lock.json