Is my project affected?

Drop your package-lock.json or paste a public GitHub repo. You get a list of hijacked packages and the exact versions to install instead.

Drop package-lock.json or choose a file

Files are read in your browser. Nothing is uploaded, and Mene never sends package names anywhere. For a repo URL, GitHub sees the request; Mene doesn't.

Try an example · a lockfile that installed the hijacked chalk 5.6.1

Want this on every build? Set up CI in 2 minutes →