Free tool
Is a known vulnerability in your dependencies?
Drop a lockfile or manifest. Every package version in it is checked against OSV.dev and CISA's exploited list, with the version that fixes each problem. The file stays in your browser.
Drop files here, or choose them
package.json · package-lock.json · pnpm-lock.yaml · yarn.lock · requirements.txt · go.mod · Cargo.lock · composer.lock · Gemfile.lock
Only package names and versions leave your browser, to OSV.dev.
The short answer
A lockfile names the exact version of every package your app installs, including the dependencies of your dependencies. Checking those versions against OSV.dev finds every published advisory that applies, and CISA's Known Exploited Vulnerabilities catalog tells you which of them attackers already use: fix those first.
What to do with the results
Start with anything marked exploited, then Critical and High. A direct dependency is fixed by raising its version in your manifest. A transitive one is pulled in by another package: update that package, or force the fixed version with npm overrides, pnpm pnpm.overrides or yarn resolutions.
New advisories are published every day, so a clean result today says nothing about next week. Vulnerability watch runs this check on a connected GitHub repository daily, writes a briefing for each advisory and opens the upgrade as a pull request.
Questions
Is my lockfile uploaded anywhere?
No. The file is read in your browser. Only the package names and versions it lists are sent, from your browser, to OSV.dev's public API. ZeusQA's server sends your browser the list of CVE IDs in CISA's KEV catalog and never sees the file.
Which files does it read?
package.json, package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, go.mod, Cargo.lock, composer.lock, Gemfile.lock. For npm, a lockfile gives the exact versions of every package, including the dependencies of dependencies; package.json alone only covers versions pinned exactly.
Where do the advisories come from?
OSV.dev, which aggregates GitHub's advisory database and the PyPI, Go, RustSec, Packagist and RubyGems databases. An advisory is marked exploited when its CVE is in CISA's Known Exploited Vulnerabilities catalog.
How is this different from npm audit?
npm audit covers npm only and reads GitHub's database. This reads seven ecosystems at once through OSV, marks what attackers already use, and names the version that fixes each one. It is a one-off check; vulnerability watch runs it on your repository every day and opens the fix as a pull request.
Related
Latest CVEs this week
Critical and High CVEs from the last 7 days, with KEV and EPSS.
Vulnerability watch
This check, daily, with a fix pull request.
Secret scanning
Keys and tokens found on the line of a pull request, never shown.
More free tools
Viewport reference, selector checker and a test prompt builder.
Run this check every day, with the fix
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the upgrade as a pull request. Three test runs free, no card.