@312npm/cve-monitor

Dependency security monitor from 312 Elements. Reports your project's dependencies on every build so we can scan them nightly for known CVEs and email you when action is needed.

What it does

• Reads your lock file (package-lock.json, yarn.lock, or pnpm-lock.yaml)
• Sends package names and versions to the 312 Elements API
• No source code, secrets, or environment variables are sent
• Always exits 0 — will never break your build

Install

npm install --save-dev @312npm/cve-monitor

Add to your build command in package.json:

{
  "scripts": {
    "build": "cve-monitor && next build"
  }
}

Domain detection

Your site's domain is detected automatically (no config needed):

1. BEACON_DOMAIN environment variable (explicit override)
2. VERCEL_PROJECT_PRODUCTION_URL (Vercel sets this automatically)
3. homepage field in package.json

How it works

On every build, the script sends your dependency list to 312 Elements. Each night, we scan all reported dependencies against the OSV.dev vulnerability database. If a CVE is found in one of your packages, you receive an email with what's affected and how to fix it.

This is a companion to npm audit — it provides ongoing, passive monitoring so you don't have to remember to check manually.

Requirements

• Node.js >= 16
• A 312 Elements account at seo.312elements.com