---
title: "Free: check every pinned version in a lockfile against the malicious-package feed."
method: POST
path: "/v1/lockfile"
---

# Free: check every pinned version in a lockfile against the malicious-package feed.

`POST /v1/lockfile`

## Request

- Base URL: `https://lazaretto.dev`
- URL: `https://lazaretto.dev/v1/lockfile`
- Auth: none declared

No auth, IP rate-limited. Send a package-lock.json, yarn.lock (v1/Berry), or pnpm-lock.yaml (v5/v6/v9), raw or as {"lockfile":"<contents>"}, or an explicit {"packages":[{"name","version"}]} list. Only EXACT versions are checked: a range has no definitive answer, because a compromised release usually sits between clean ones. Fail-closed: anything that could not be checked is listed in `unverified`, so an empty `malicious` list is only an all-clear when `unverified` is empty too. `skipped` counts entries with no registry identity (file:/link:/workspace:/git), which are reported rather than silently dropped.

## Response `200`

Malicious pinned versions, plus whatever could not be checked.

## Other responses

- `400`: Unrecognized lockfile, or no exactly-pinned versions in it.
- `429`: Rate limited.
- `503`: The feed could not be consulted. Not an all-clear.

---

[API](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api.md) · [All operations](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api/llms.txt) · [OpenAPI document](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api/revisions/2bd4e34d0067?raw)