Blast Radius / Run a check

Measure a compromise before it measures you

Name the package and the bad version. This walks the dependency graph five hops out, resolves every declared range against that version, and tells you which of the two numbers actually matters.

Use the API Monitor it

The incident

Pick a documented compromise or type any package in the crawled graph.

Real incidents:

Is my app affected?

Drop a real package-lock.json. It is read in your browser, posted once, and never stored. The check runs against the incident above and returns the exact dependency path that reaches you.

Drop your package-lock.json
or · v1, v2 and v3 all work

Is anything already malicious?

The check above answers "am I exposed to this incident". This one answers the question you have before anyone tells you there is an incident — every package in your lockfile against osv.dev, including MAL- identifiers for confirmed malicious packages.

Scan my package-lock.json for known malware
or · checked live against osv.dev · nothing is stored

Walk the graph yourself

Every node is a real vertex in HydraDB. Click one and the browser asks the database what is adjacent to it — packages, the people who publish them, and the advisories filed against them.

graph explorer
hydradb-explorer — click a node to expand it, drag to rearrange

npm, right now

Every package published to npm in the last few minutes, checked against the graph as it arrives. The ones worth watching are the packages thousands of things already depend on.

live publish feed connecting…
npm-changes.log — polled from replicate.npmjs.com every few seconds

The system, right now

Pushed over server-sent events, not polled. The same health check verify.py and chaos.py assert against.