npm package report
Is which safe?
Checked against the XYZ decision brain: known-malicious corpus, advisories, commit-level findings, dependencies and provenance.
npm packagelast checked 2026-09-19
which · verdict ALLOW · no known risk
0.6/10
XYZ SCORE
SUMMARY
Verdict ALLOW · 7 graph-tracked dependencies · provenance: verified (sigstore)
All signals clearclearOK
No known-malicious match, advisory, commit-level finding or anomaly.
is-absolute@^0.1.7clean
isexe@^1.1.1clean
mkdirp@^0.5.0clean
@npmcli/eslint-config@^4.0.0clean
@npmcli/template-oss@4.14.1clean
rimraf@^2.3.3clean
tap@^1.0.2clean
PACKAGE whichECOSYSTEM npmDECISION ALLOW
Package facts
Weekly downloads
1.3B
Centrality tier
tier 1
Build provenance
verified (sigstore)
Direct dependencies
7
Baked snapshot · run a live check for the current verdict · browse all packages
Other package reports
winstonwsxml2jswebpack-sourceswebpack-dev-serverwebpack-dev-middleware