Watch a Muse agent read an npm package

Muse Spark Open opens the published archive, decides where to look, and has to cite every line it relies on. The package is read in memory on our server and never executed.

Try: (reported malware, still on npm)

Is your project affected?

Paste a package-lock.json, pnpm-lock.yaml or yarn.lock, or pick the file. We check every locked version against reported malware and look for packages from outside the registry. Nothing is stored or installed.

On your own machine

Stop malware before npm install runs it, for you or your AI coding agent. No account and no GPU, under a minute:

uv tool install git+https://github.com/lb2002/gatekeeper
gk guard setup
gk guard shell

In your project, gk audit does the lockfile check above. In CI: uses: lb2002/gatekeeper@v2.3.