TrackLeaks

Exposure Response Platform

Know what leaked.
Know if it matters.
Fix it.

Check a password, an npm package, or a whole lockfile — instantly and free. If something is exposed, TrackLeaks shows you where it sits and what to do next.

Start monitoring Browse threat intelligence

Did it leak?

Free

Checked against TrackLeaks intelligence: confirmed-malicious and suspicious npm releases.

Free, no account required.

For your codebase

Continuous supply-chain exposure response.

The one-off lockfile scan above, run automatically against every repository you connect.

Intelligence architecture

  • npm RegistryNot configured
  • GitHub AdvisoriesNot configured
  • OpenSSF / OSVComing soon
  • TrackLeaks AnalysisConnected

How it works

One pipeline: ingest, match, respond.

01

Ingest

npm registry replication and GitHub malware advisories, polled continuously with source provenance recorded on every record.

02

Match

Your dependency graph is resolved from lockfiles, then intersected against affected version ranges — not just package names.

03

Respond

Prioritized exposures with dependency paths, evidence, and a cooldown policy that stops the next one landing.

Latest intelligence

Demo data

Public feed of package releases flagged as suspicious or confirmed malicious.

View all threats

One platform, four exposures

Dependencies ship today. The same ingest-match-respond engine extends to every class of leak that reaches your organization.

Dependencies

Live

Compromised and suspicious packages matched against your real dependency graph — direct and transitive.

Identities

Soon

Credential dumps and breach corpora matched against the identities in your organization.

Secrets

Soon

Leaked API keys and tokens correlated to the services they unlock in your environment.

AI

Soon

Model, agent, and MCP supply-chain exposure as AI tooling enters production.

For you

Personal exposure, same engine.

The checker above is free and always will be. Personal monitoring is being built in the open — here is exactly where it stands.

Password checker

Live

k-anonymity lookup against the Pwned Passwords corpus. Your password never leaves your browser.

Email monitoring

Coming soon

Tell us where to reach you and we'll notify you the day breach monitoring for an address goes live.

Personal exposure monitoring

Roadmap

Continuous watch across breach corpora and leak sources for the identities you care about.

Connect a repository. See your exposure in minutes.

Read-only GitHub access. No code leaves your repositories — TrackLeaks reads manifests and lockfiles only.

Create your workspace