Install-script scanner

Paste a package-lock.json to see which packages declare install scripts (code that runs on npm install), and which dependencies come from git, a URL or a local file instead of the registry.

Nothing leaves your browser. No request is made; the check is JavaScript on this page. It reads npm's own hasInstallScript marker, so it needs a lockfile from npm 7 or later (lockfileVersion 2 or 3). It does not say whether a script is malicious, only that one exists. See the hardening checklist for what to do with the list.

package-lock.json

How to read it

Install scripts run with your environment when you install. Most are legitimate (native builds, downloading a binary); review the ones you don't recognise, and consider allowing only the packages you need to build.
git, URL and file dependencies are not published through the registry, so registry protections (immutable versions, provenance, a removal process) may not apply.
Registry entries with no integrity hash can't be verified against the lockfile.