Free tools Windows power users keep installed
One-click scans. No signup required.
If a package your project uses was compromised, first find out whether an affected version was resolved and whether it ran. If it may have executed, contain the systems it touched, rotate credentials it could access from a trusted environment, check for unauthorized changes, then rebuild with a version confirmed safe by a trustworthy advisory. A lockfile can show what was installed; execution logs help show whether it ran.
How do I know if my project used the compromised package?
Start with the official advisory from the package maintainer, registry, or relevant security authority. Record the exact package name, ecosystem, affected versions, publication window, reported behavior, and any version identified as safe. Do not assume that every release—or every package with a similar name—is affected.
As an Amazon Associate I earn from qualifying purchases.
Check direct and transitive dependencies
Search manifests and lockfiles for the package and affected version. A package can be present indirectly through another dependency, so inspect the resolved dependency graph rather than checking only the top-level manifest. CISA’s npm campaign advisory specifically advises checking lockfiles for affected packages, including nested dependencies.
Then compare dependency records with build and installation records. A lockfile can establish that a version was resolved for a project; it does not, by itself, establish when or where it was installed or whether its code executed. Record which developer machines, CI runners, build servers, and deployment systems fetched or ran it, and note the relevant time window. GitHub’s incident-response guidance recommends documenting the affected scope and incident timeline.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should I do first if the package may have run?
Contain affected execution before treating the issue as a routine dependency update. Depending on the system’s role and operational impact, stop or isolate the affected job or machine. Preserve relevant logs and records before rebuilding, cleaning, or otherwise changing the system.
Scope beyond application source. A package’s installation or execution may have coincided with credential theft, workflow changes, or data exfiltration; GitHub’s incident-response guidance describes these as possible parts of a supply-chain incident. Check the developer machines, CI and build infrastructure, and deployments that accessed the affected version. Keep a short timeline of what ran, where, and when.
Should I rotate my API keys and other credentials?
List credentials the affected process could access, such as registry and source-control tokens, cloud credentials, SSH keys, deployment credentials, and secrets injected into jobs. Revoke or rotate those with a plausible exposure path, then update the systems that depend on them. GitHub’s guidance is explicit: “Even if you’re not certain a credential was compromised, rotate it if there’s any possibility of exposure.” Do this from a trusted machine or environment if the affected host may be compromised.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
CI deserves particular attention: credentials can be available to a job even if the package never reached a production server. CISA’s Axios advisory includes secrets injected into compromised ephemeral CI jobs. Assess what the affected job could access rather than assuming that a short-lived runner had no sensitive credentials.
What unauthorized changes or persistence should I look for?
Use the package-specific advisory to guide the investigation: the relevant indicators depend on the reported behavior and the privileges available to the package. Review the systems and accounts it could reach, not only the repository where the dependency appears.
- Check workflow files, repository changes, webhooks, deploy keys, and relevant audit logs for unexpected modifications.
- Review installed source-control or OAuth apps, self-hosted runners, and binaries the package could have added or changed.
- Inspect the affected host and any cloud or source-control accounts accessible to the process.
- Preserve findings and timestamps as you investigate; record what you checked and what remains uncertain.
GitHub’s investigation areas offer additional places to examine. A generic malware scan can contribute evidence, but it is not a complete forensic examination.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do I remove the compromised version and restore the project?
- Choose a trusted target. Use a version identified as safe in a trustworthy maintainer or registry advisory. If the advisory does not establish a safe version, do not guess; follow its status updates or maintainer guidance.
- Update the resolution. Change the manifest and lockfile as needed to exclude affected versions. Review the final dependency graph, including transitive dependencies, rather than relying on the top-level manifest alone.
- Reinstall from a trusted source. GitHub recommends pinning to known-good versions or commit SHAs and reinstalling from trusted sources. Confirm the resulting resolution against the advisory and your recorded scope.
- Rebuild and restore deliberately. Rebuild affected outputs from a trusted environment after containment and credential response. Restore deployments only when the dependency resolution and relevant systems have been checked.
Avoid blindly running automatic upgrade or audit-fix commands during an incident. For example, npm documents that npm audit fix runs an install under the hood, and installer configuration affects that operation. Understand what a command will change and where it will fetch packages before using it in recovery.
What if the package was only installed in CI?
“Only CI” does not determine the risk by itself. Establish whether the affected version was merely downloaded, installed, or executed, and what the job could access. Review the runner’s logs and job configuration alongside its injected secrets, permissions, artifacts, and any workflows or deployment steps that ran afterward. If the package may have executed with access to credentials, handle those credentials according to their exposure path, even if the runner was ephemeral.
Separate the systems involved: a package resolved in a lockfile, a package fetched by a runner, and package code executed during a job are different findings. Use dependency records to establish resolution and build or job records to establish activity; neither alone answers every part of the incident.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How can I verify recovery and monitor for follow-on activity?
Confirm that affected versions are absent from the relevant dependency graph and that credentials considered exposed have been revoked or replaced. Review code, secret, and malware alerts, along with system and account audit trails, for activity during and after the incident. Dependabot’s malware alerts documentation explains one source of package-related alerting.
Treat an alert or a clean audit as one evidence source, not proof that no malicious execution occurred. Compare dependency resolution with execution records and the package-specific advisory, and continue monitoring the systems and accounts that were within reach of the affected process.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
