Public package diff

Diff any npm, PyPI, or atpm package.

See exactly what changed between two published versions — every file, line by line, with the same deterministic supply-chain checks Drydock runs on staged releases. Paste a pkg.pr.new URL to review a pull-request preview build before it ships. No account needed.

See a real incident

node-ipc

9.2.1 → 11.0.0

protestware arrives as a new dependency (peacenotwar)

semversyphus

1.0.5 → 1.0.6

a postinstall script appears — demo of the install-script rule

es5-ext

0.10.53 → 0.10.54

real protestware: a postinstall hook lands in a routine patch, still live on npm

Why diff the artifact

Registry tarballs can differ from the repository: build output, install scripts, and files that never saw a pull request all ship in the artifact. Diffing the published bytes is how compromised releases like axios and node-ipc were spotted — after they shipped. Drydock runs the same review before a release goes live.

Every finding on this page comes from Drydock's deterministic rules — the package code is never executed and no AI reviews this surface, so the same versions always produce the same report.