Skip to content
privatenpmREGISTRY
Start free trial
Menu

Lockfile registry inspector

Find registry and tarball hosts in npm, pnpm and Yarn lockfiles. Spot old hosts and insecure URLs before a registry migration.

Runs in your browser. Inputs stay on this page and are cleared when you reload. No uploads, analytics or session replay. Use placeholders instead of real secrets.

Enable JavaScript to run this local tool, or follow the step-by-step guide.

Tool inputs

Inspect registry references

Up to 2 MiB. npm lockfiles are parsed as JSON. pnpm and Yarn files are scanned for explicit HTTP(S) URLs; registry-relative entries cannot identify a host.

Other hosts are highlighted for review. Public dependencies may legitimately use other hosts.

Your result

Choose your inputs, then run the tool.

Find hosts before a migration

A lockfile can keep an old tarball URL after you change the scope route. Compare the hosts below with your intended registry and review each unexpected host.

The inspector lists explicit resolved URLs, not a dependency graph. It does not contact hosts, validate integrity hashes or establish where registry-relative entries will download. Credentials, query strings and fragments are omitted from the report. At most 200 unique URLs are displayed.

For npm lockfile structure, see package-lock.json. Review and regenerate lockfiles with your package manager; changing URLs by hand can break integrity and authentication.

Continue with Configure a registry domain or explore all developer tools.