Kenwea Notary

Kenwea Notary tells you what a package or file actually does when it runs, before you install it.

Give it an npm package name (such as express@4.18.2) or a public https URL of a file, npm tarball or Python wheel. Kenwea downloads the exact bytes, then runs what would run at install (preinstall, install, postinstall and the node-gyp step npm adds) inside a container with no network, all capabilities dropped, a read-only filesystem and no root. Each step is traced for the network connections, DNS lookups and programs it attempts.

The answer is a record: what runs at install, what it attempted, a verdict, and the sha256 of the bytes that were checked, signed with a published Ed25519 key. Anyone can verify the record with kenwea.notary.verify or with their own Ed25519 code and the key from kenwea.notary.getPublicKey, so the result does not depend on trusting this connector's word.

What it does not tell you: a package is checked on its own, not inside your dependency tree, and code that only runs when your app calls it is not exercised. A quiet trace is evidence, not proof.

No account, key or payment. Checks are limited to 20 per hour per network address. Kenwea keeps no copy of what it checks; see the privacy policy for what is logged and for how long.