Who's There? See who can push code to your app

Who's There? is a free security tool for software teams. It reads a project's npm lockfile in your browser and lists every person who can publish code into the project's dependencies, then flags the accounts an attacker might take over: maintainer email domains anyone can buy, new maintainers, releases that skip CI, and code that runs on install.

Scanning needs no account. Signing in with Google is optional: it lets you save projects, watch them for changes and get alerts. We use only your name, email address and profile picture to identify your account, and never sell or share them.