# PackageFix

> Paste your manifest. Download the fix. No CLI, no signup.

- **Website**: https://packagefix.dev
- **Uneed Page**: https://www.uneed.best/tool/packagefix
- **Pricing**: Free
- **Category**: Development
- **Tags**: Open Source, Development, Security
- **Submitted by**: @metriclogicllc-113a
- **Launch Date**: 2026-07-06
- **Social Links**: [GitHub](https://github.com/metriclogic26/packagefix)

## About

PackageFix is a free browser-based dependency security fixer. Paste your manifest file and get back a fixed version with every vulnerable package patched.

Supports 7 ecosystems: npm, PyPI, Ruby, PHP, Go, Rust, and Java/Maven.

Beyond CVE scanning — also detects:
- Glassworm/Unicode injection in manifest scripts
- Typosquatting (one char off a popular package)
- Zombie packages (unmaintained but widely used)
- Suspicious maintainer activity
- Build script danger (curl/wget in postinstall)
- Unpinned version warnings

Uses the OSV vulnerability database (updated daily) and CISA KEV catalog. Everything runs client-side - nothing leaves your browser.

MIT licensed, open source.
github.com/metriclogic26/packagefix