Darnlynpm package checker: is this package safe to use?
Your AI agent suggested a package you’ve never heard of? Type its name to see how popular it is, when it was last updated, its license and more, with a clear verdict. Compare up to three.
Free from Darnly. Spot a bug in the app you're building? Darnly hands it to Claude Code, Codex or Cursor in one key.Add to Chrome
Try:
More free tools
See all 89 tools- JSON to TypeScriptPaste JSON and get TypeScript types and a Zod schema, with optional fields found for you.
- Diff checkerCompare two texts side by side and see every added, removed and changed word. Nothing is uploaded.
- px to rem converterpx to rem and back, live, with the matching Tailwind class and a ruler at real size.
How it works
- Type the name of a package, or up to three to compare. You can paste an
npm installline or an npmjs.com link too. - We read the package from the npm registry: its latest version, license, dependencies, size, maintainers, TypeScript types and deprecation notice, plus its weekly downloads for the last year.
- Each fact gets a green, amber or red mark, and the package gets a one-line verdict. Copy the result for your AI agent, or copy the install command.
Questions
How do I know if an npm package is safe to use?
Look for four things: lots of weekly downloads, a release in the last year, a normal open source license like MIT, and no deprecation notice. This tool checks all of them at once and marks anything that needs a second look.
My AI agent suggested a package I’ve never heard of. Should I install it?
Check it here first. AI agents sometimes invent package names that sound right, and attackers register those names with harmful code. A package that doesn’t exist, or has almost no downloads, is a sign to ask the agent again.
What does “abandoned” mean here?
Nothing new has been published in over two years. Amber means over a year. Some small, finished packages don’t need updates, so treat it as a prompt to look, not a ban. A deprecated package is different: its author has asked people to stop using it.
Is a package with one maintainer bad?
No, most packages have one. It just means everything rests on one person, so for something your whole app depends on, a package with a team behind it is a little safer.
Does this check for viruses or security holes?
No. It checks the signs of a healthy, trustworthy package. For known security problems in packages you already use, run npm audit in your project.
Where does the data come from?
Straight from the public npm registry and npm’s download counts. Results are kept for up to an hour, so a brand new release can take a little while to show.