Paste one dependency file. In a few seconds you get every package that is abandoned, formally deprecated, carrying a public advisory, or on a licence that bites when you sell software.
No signup. We never store what you paste.
Questions
Do you store my dependency file?
No. It is parsed in memory to work out which packages to look up, and then discarded. Nothing about your manifest is written to a database, and there is no account to create.
Where does the data come from?
Package metadata — latest version, publish date, deprecation status, licence and source repository — comes from deps.dev, run by Google. Known vulnerabilities come from OSV, the open-source advisory database. Adoption verdicts are ours.
Is an unmaintained package actually a problem?
Not always. Small, finished libraries genuinely stop needing releases. It matters when the package touches authentication, parsing, networking or anything else with a security surface — there, no releases means no fixes.
What formats can I paste?
package.json, requirements.txt, pyproject.toml (PEP 621 or Poetry), go.mod and Cargo.toml. We detect the format automatically, so you can just paste.