npm Tarball Inspector
Reads an npm package tarball (.tgz) — package.json fields, dependencies, and every file inside — and flags lifecycle scripts (like postinstall) worth a second look before you install it.
Drop a .tgz file here, or click to choose one
Works entirely offline in your browser. Nothing is uploaded.
When you'd use this
- Checking what files a published npm package actually includes
- Reviewing a package's contents before publishing it yourself
- Investigating what's inside a downloaded .tgz package tarball
Flagging a script doesn’t mean it’s malicious — install/postinstall scripts are extremely common and usually benign (e.g. compiling a native addon). It’s meant to draw your eye to what’s there, not to make a judgement for you.