Enter a public URL. We identify npm packages and versions where evidence is available, check known vulnerability advisories, and show how each package was detected.
Keep checking after launch with scheduled audits and email alerts.
No repository access. No CI plugin. Nothing to install.
Your public URL → detected packages → advisories and evidence
How the scan worksSee which packages were detected, how we identified them and which advisories need review.
Explore the example reportGive us the URL of a site you own or manage. The scanner loads the page and inspects the JavaScript it serves.
https://fernhill.exampleGuest audits inspect the entry page and its JavaScript. Signed-in users can enable crawling to a chosen depth on the same origin, and scrolling to discover more JavaScript.
Runtime values, source maps, file hashes and other traces help identify npm packages, even in minified code. Each detection includes its evidence; an exact version is not always available.
reactsymbol match>= 18.0.0astrometa generator5.13.2clipboardcomment banner2.0.11@popperjs/coresourcemapunknownbootstrapruntime5.3.8We check detected packages against known vulnerability advisories. Review severity, affected versions and patch information where available. Possible matches without an exact version stay unverified.
package → version → advisory → next stepReview the scan totals and AI analysis, then explore detected packages, their evidence and matching advisories.
Based on a recorded scan, with the site name and URLs replaced by fernhill.example. Saved reports also include AI summaries, changes since the previous audit and PDF export.
Based on a real scan · 2026-09-10 · Site name and URLs anonymized
Overall risk This scan detected 5 packages and recorded 19 confirmed advisories, plus 2 unverified matches. Prioritize astro@5.13.2: the recorded findings include a critical advisory involving AVIF image optimization.
What changed No previous audit is included in this example, so new or resolved advisories cannot be determined.
Priorities
astro advisory and check whether your deployment uses the affected image optimization feature.react >= 18.0.0 and @popperjs/core, then run another audit to reassess their advisories.Caveats A package-version match does not prove exploitability. The React matches remain unverified. No advisories were recorded for [email protected], [email protected] or @popperjs/core; this does not establish that they are vulnerability-free.
This is a dated example, not a current assessment. Confirm findings against your own build before acting.
Save your site and choose a schedule. Get a report at your account email after every audit, or only when a new confirmed advisory appears. With the Oversee subscription tier, choose up to ten recipients per site. Each report shows what changed and links to the evidence.
| Run | Changes | |
|---|---|---|
| Tue 06:00 | Queued | |
| Mon 06:00 | +1 high | Sent to 2 |
| Sun 06:00 | No change | Not sent |
| Sat 06:00 | 1 resolved | Not sent |
| Fri 06:00 | No change | Not sent |
| Thu 06:00 | No change | Not sent |
1 new confirmed since the previous audit
One new high-severity advisory since yesterday’s audit: astro@5.13.2 is affected by reflected XSS via the server islands feature (GHSA-wrwg-2hg8-v723). Fix first: upgrade astro past 5.15.6, then run the audit again to confirm.
Built for solo developers and indie makers looking after their own apps or client sites. Check the JavaScript you deployed, share the findings with whoever maintains it, and keep monitoring after launch.
Start with 10 free audits3 free audits as a guest; 10 free audits after registration. No card required. Buy tokens as needed, or choose a subscription for regular monitoring. Every plan includes AI summaries, PDF export and email reports.
No subscription required. Buy tokens as needed with a one-time purchase. They never expire. View token packs.
For a personal project or a single production app.
For agencies and teams shipping several apps.
For platforms that need to know within the hour.
About npm audit, free audits and automated alerts.
Module Audit is a website vulnerability monitoring tool for small businesses and developers. Enter a public URL for a site you own or manage to identify npm packages in its deployed JavaScript and check for known module vulnerabilities. No repository access or installation is required.
The npm audit command checks dependencies in your project. Module Audit inspects the JavaScript served by your live website, identifies packages and checks them against known vulnerability advisories. Use both to check your project dependencies and what you actually deployed. Module Audit cannot see server-only packages or guarantee detection of every package in a minified bundle.
Module Audit helps small business teams monitor business websites and client apps. It also serves freelancers, indie and individual developers, vibe coders building with AI, and citizen developers creating business apps with low-code tools. It checks publicly reachable JavaScript, so coverage depends on what your site exposes.
After registration, save your site and choose an audit schedule. Receive a report at your account email after every scheduled audit, or an alert only when a new confirmed advisory appears. The Oversee subscription tier lets you choose up to ten recipients per site. Schedules range from hourly to weekly depending on your plan. Each audit uses one token; if your balance runs out, audits are skipped and you are notified by email.
3 free audits as a guest; 10 free audits after registration. No card required. Guest audits are manual. Registration unlocks scheduled audits and email reports. The free audits are a starting allowance; buy a plan or token pack when you need more.
One audit uses one token, whether you start it manually or run it on a schedule. Subscription plans include a monthly token allowance. You can also buy token packs, which never expire. Your plan determines how many sites you can manage and how often scheduled audits can run.
An unverified advisory is a possible match that the available evidence cannot confirm, for example when a package is identified but its version is unknown. Review the package evidence and check your own build before deciding whether the advisory applies. Module Audit is in beta, so detections can also be missed or incorrect.
Guest audits inspect the entry page and its JavaScript. Signed-in users can optionally enable crawling on the same origin, with a depth of 1–4 and up to 20 pages, and scrolling to discover more JavaScript. Coverage is limited to the pages and assets observed; the scanner does not click controls, submit forms or inspect every application state.
Yes. Deleting a site from its settings removes that site, its schedule and all of its reports. Detection methods continue to change during beta, so a later audit of the same URL may produce different results.
Yes. Download the full report as a PDF to share with your developer, client or team. The Oversee subscription tier lets you choose up to ten email recipients per site, including addresses other than your account email. Other plans send reports only to your registered account email. Email reports include a summary and a link to the full report.
Read the official npm audit documentation for project dependency checks, or compare audit plans and schedules for your deployed sites.
Start with a report, then schedule repeat audits and email alerts. Buy tokens when you need them; no subscription required.