Not found in the npm registry — this version appears unpublished, never existed, or is a private/internal package. It isn't installable from the public registry; upload it for review if it's a custom package.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Security findings (1)
Static analysis rule matches, with the exact code that triggered them.
"typescript@5" could not be fetched from the npm registry. It may be unpublished, have never existed, or be a private/internal package the cloud can't see. This is re-checked on every scan (never cached) because a currently-missing name can be published at any time (dependency confusion). If it's a legitimate custom package, upload it for review so ShadowCanopy can inspect its code and remember it.
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/typescript