Eu cra article 13 checklist — check your lockfile free

Flags install scripts, missing or sha1 integrity, http, git and off-registry tarballs in package-lock.json: the third-party component check behind EU CRA Art. 13(5). 8 rules, line numbers. Runs entirely in your browser — nothing is uploaded.

{
  "name": "invoice-portal",
  "version": "2.4.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "invoice-portal",
      "version": "2.4.0",
      "dependencies": {
        "express": "^4.21.2",
        "left-pad": "latest",
        "ms": "^2.0.0",
        "pdf-sign": "^1.3.0",
        "sharp": "^0.33.5",
        "tiny-csv": "github:acme-dev/tiny-csv"
      }
    },
    "node_modules/express": {
      "version": "4.21.2",
      "resolved": "https://registry.npmjs.org/express/-/express-4.21.2.tgz",
      "integrity": "sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA==",
      "license": "MIT"
    },
    "node_modules/left-pad": {
      "version": "1.3.0",
      "resolved": "http://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
      "integrity": "sha512-XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQEXjvAu+Hh5fbgjYnhiE7Aj6H5Ov5PoEFSV6gVcQA7Q77hQ==",
      "license": "WTFPL"
    },
    "node_modules/ms": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
      "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g=",
      "license": "MIT"
    },
    "node_modules/pdf-sign": {
      "version": "1.3.0",
      "resolved": "https://cdn.acme-files.net/npm/pdf-sign-1.3.0.tgz",
      "integrity": "sha512-Qm3kP0y1f9QZC6yJ3v7o2bJp0YwqfW3m7lQx9m1zS8wqg4r6c1p0Yk2p8q5tq0bq7kQ1kU1v5o2r8s9t0u1v2w==",
      "license": "MIT"
    },
    "node_modules/sharp": {
      "version": "0.33.5",
      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.33.5.tgz",
      "integrity": "sha512-haPVm1EkS9pgvHrQ/F3Xy+hgcuMV0Wm9vfIBSiwZ05k+xgb0PkBQpGsAA/oWdDobNaZTH5ppvHtzCFbnSEwHVw==",
      "hasInstallScript": true,
      "license": "Apache-2.0"
    },
    "node_modules/tiny-csv": {
      "version": "0.4.1",
      "resolved": "git+ssh://git@github.com/acme-dev/tiny-csv.git#main",
      "license": "ISC"
    }
  }
}

as of

Free here: Scan one package-lock.json: every install script, weak or missing integrity, http, git and off-registry source, with its line and the fix.. In the editor: Scan every lockfile in the workspace at once and export a dated due-diligence record (Markdown and CSV) for your CRA technical documentation. — that part asks for a licence key.

Same engine as the VS Code extension, byte for byte.