Observed arrival · 2026-10-24
Canary reads new npm and PyPI releases before installation
A read-only package watcher that flags releases against published rules and lets visitors check dependency files against its wall and public malware records.
- For
- Developers reviewing npm or PyPI dependencies
- Worth noticing
- The site reserves “confirmed” for a matching OSV or OpenSSF malware advisory; its own rule-based findings remain “tripped.”
Field notes
Canary describes a feed-to-inspection pipeline: new npm and PyPI releases are fetched and examined without installation or execution, with findings tied to specific files and lines. Its checker accepts several manifest and lockfile formats, allows up to 500 names per check, and says submitted text is dropped after parsing. The homepage distinguishes its own rule-based “tripped” findings from versions matched to public OSV or OpenSSF advisories.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue