Paste one npm or PyPI name (for example one an AI assistant just suggested). Free, no signup. The check runs in your browser against the public npm, PyPI, OSV and deps.dev APIs; static signals only, nothing is downloaded or run.
The Package Sus Detector Actor on Apify checks a whole package.json, requirements.txt or lockfile, diffs a pull request against its base branch, adds download-count signals for PyPI and can fail your CI. It is paid, pay-per-event ($0.01 per package checked), and I built it. This page runs the same open-source (MIT) checks one package at a time.
Try the Actor on Apify GitHub Action for pull requests ยท Source (MIT)
Risk signals, not accusations. Results are automated signals computed from public registry and advisory data. A suspicious or caution verdict means "look closer before installing", not that a package or its author is malicious. A clean result is not a guarantee of safety. Not security advice.