Dependency Audit

Dependency Audit analyzes your project's dependency tree for security vulnerabilities, license issues, and supply chain risks. It goes beyond simple CVE matching to assess transitive dependencies, evaluate maintenance health, and detect potential typosquatting attacks.

How It Works

1. Manifest parsing — Reads package.json, requirements.txt, Gemfile, go.mod, Cargo.toml, and their lock files
2. CVE matching — Cross-references all direct and transitive dependencies against vulnerability databases (NVD, GitHub Advisory, OSV)
3. License analysis — Identifies license types and flags incompatible combinations (e.g., GPL in MIT projects)
4. Health assessment — Checks maintenance signals: last publish date, download counts, maintainer changes
5. Supply chain checks — Detects typosquatting, install scripts, and suspicious package metadata

Best For

• Regular security audits of project dependencies
• Due diligence before adopting new open-source packages
• License compliance for commercial software projects
• CI pipeline integration for automated vulnerability gating

Ecosystem Support

Full support for npm (JavaScript), pip/Poetry (Python), Cargo (Rust), Go modules, Maven/Gradle (Java), Bundler (Ruby), NuGet (.NET), and Composer (PHP).