npm, PyPI, crates.io and Maven. Data updated 2026-11-12 11:22 UTC.
Check a package and its dependencies
Type a package. The checker resolves its whole dependency tree and checks every package in it against the advisories in limbo: published by maintainers, not yet in the databases Dependabot, npm audit and OSV-Scanner read.
What it checks, and what it doesn’t
- The dependency tree comes from deps.dev, resolved for the package on its own. Your browser asks deps.dev directly, so limbo.watch doesn’t see what you check. Your own lockfile may resolve other versions: to check exactly what you install, run limbowatch scan on your project.
- Only advisories in limbo are checked. Advisories GitHub has reviewed already reach your usual scanner.
- Each package is matched by name and version, with the same rules as limbowatch scan. A range that can’t be read exactly, or that contradicts its own fixed version, is shown as “possibly affected”, never passed silently. Ranges are as entered by maintainers and haven’t been reviewed.
- Advisories whose package name is unusable are matched by limbowatch scan through the package’s source repository; this page can’t do that.
- deps.dev resolves trees for npm, PyPI, crates.io and Maven. For Go, RubyGems, Packagist and NuGet, use limbowatch scan or search the tracker.