Free dependency scan - no account, file never stored
xz was one trusted account. Count yours.
Drop a lockfile. In seconds you will know which of your dependencies a single account can publish straight into your next build - who holds that power and how far it reaches. Free, no signup, and the file is parsed in memory and discarded.
Drop your lockfile
- never stored
- 19 formats
- ~10 seconds
Drop one of these here
- package-lock.json
- pnpm-lock.yaml
- go.mod
- Cargo.lock
- Gemfile.lock
- composer.lock
or any of 19 formats
- JavaScript and TypeScript
- package-lock.jsonyarn.lockpnpm-lock.yamlpackage.json
- Python
- poetry.lockPipfile.lockrequirements.txtpyproject.toml
- Go
- go.sumgo.mod
- Rust
- Cargo.lockCargo.toml
- PHP
- composer.lockcomposer.json
- Ruby
- Gemfile.lock
- Java and Kotlin
- gradle.lockfilepom.xml
- .NET
- packages.lock.jsona .csproj project file
Bold names are lockfiles - they carry the resolved tree, so they name the ~300 packages you ship rather than the ~20 you chose. Detection is by filename only: guessing from contents gives a confident wrong dependency list.
Or paste it
Parsed in memory, never written down. There is no database column that could hold your file.
What happens to my file?
It becomes a list of package names, in memory, and then it is gone - no log, no database, no column anywhere that could store it. What we do keep is a shared cache of public registry facts (“npm says lodash lives at this repository and lists three publishing accounts”) - the same row is written whoever asks, which is why the second scan of a React app is nearly instant. If you ask for the emailed report, we keep your address and the verdict on this screen. Never the file.
What a real scan looks like
5 of 18 dependencies can be published by a single account.
Four accounts. ~2.1 billion downloads a month between them. None of them are on this team’s payroll.
zod975M downloads/30done account can publish it@types/react559.2Mone account (DefinitelyTyped)@types/react-dom455.7Mthe same accountbcryptjs49.7Mone accountpostgres48.7Mone account
Real scan, run 2026-07-29 on a real package.json.
Run mineYou pay for the audit. You pay the accounts nothing.
- SOC 2: paid.
- Pentest: paid.
- WAF: paid.
The accounts that can publish code into your next install: unpaid, unvetted, and not on your org chart.
In 2024, one trusted maintainer account shipped a backdoor into xz that reached distro builds (CVE-2024-3094). No zero-day, no stolen laptop - the trusted account itself. This scan counts how many accounts hold that kind of position in your stack.
That was the code you did not write.
Somewhere in your own repos is your zod: one person, load-bearing, and able to resign. Busfactor reads your codebase the way this scan read npm - who actually knows each part, what breaks the week they leave, what it costs, and what to hand over first. You cannot fix npm. That one you can fix.
All 19 formats
Formats we read, by name: package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, Pipfile.lock, pyproject.toml, go.mod, go.sum, Cargo.toml, Cargo.lock, composer.json, composer.lock, Gemfile.lock, pom.xml, gradle.lockfile, packages.lock.json, a .csproj project file.
Maintain one of the projects linked here and want its page down? support@busfactor.tech - no form, no justification.