depsafe

Know what your dependencies actually do to your code.

Most security scanners tell you "lodash has a CVE." depsafe tells you "lodash has a CVE in cloneDeep, but you only use debounce — you're safe."

$ npx depsafe pallets/flask

  depsafe
  ───────────────────────────────────────────────────────
  Repository   pallets/flask (main)
  Ecosystems   pypi
  Health       D (65/100)
  Dependencies 24
  Files        35 analyzed
  CVEs         15 (13 in usage path!)

  Production Dependencies (21)
  ───────────────────────────────────────────────────────
  flask@*                   F  █████████░ 90%  7 CVEs
  [email protected]              F  ███░░░░░░░ 25%  5 CVEs
  [email protected]            F  ██████████ 100% 3 CVEs
  [email protected]              C  ██░░░░░░░░ 20%
  [email protected]               A  ██████████ 100%

  Vulnerabilities (15)
  ───────────────────────────────────────────────────────
   CRIT  GHSA-xxxx  IN PATH
    Remote code execution in Jinja2 template rendering
    Fix: upgrade to 3.1.6

Why depsafe?

| Feature | depsafe | Dependabot | Snyk | npm audit | |---|---|---|---|---| | Usage-path CVE scoping | Yes | No | No | No | | Dead-weight detection | Yes | No | No | No | | 11 ecosystems | Yes | Yes | Yes | npm only | | Health scoring | Yes | No | Yes | No | | Zero dependencies | Yes | N/A | No | N/A | | Free | Yes | Yes | Freemium | Yes |

Install

# Run instantly (no install needed)
npx depsafe facebook/react

# Or install globally
npm install -g depsafe
depsafe facebook/react

Usage

# Analyze any GitHub repository
depsafe facebook/react
depsafe pallets/flask
depsafe rust-lang/cargo
depsafe golang/go

# Full GitHub URL
depsafe https://github.com/torvalds/linux

# Auto-detect from current git repo
depsafe .

# With GitHub token (higher rate limits + private repos)
depsafe facebook/react --token ghp_xxx
# Or set the env var
export GITHUB_TOKEN=ghp_xxx
depsafe facebook/react

# JSON output (for CI pipelines)
depsafe facebook/react --json

CI/CD Integration

depsafe exits with code 1 when CVEs are found in your usage path — perfect for CI gates.

# GitHub Actions
- run: npx depsafe ${{ github.repository }}

# GitLab CI
dependency-check:
  script: npx depsafe $CI_PROJECT_PATH

What It Analyzes

For every dependency, depsafe determines:

• Which exports you actually use — traced from your import/require/use statements
• Whether CVEs affect your code — mapped to your specific usage path
• How much is dead weight — percentage of the package you never touch
• Health score (0-100) — combining usage ratio, CVE exposure, and maintenance signals

Supported Ecosystems

| Ecosystem | Manifest | Import Parsing | CVE Source | |---|---|---|---| | Node.js / TypeScript | package.json | ES imports, require() | OSV (npm) | | Python | requirements.txt, pyproject.toml, Pipfile | import, from...import | OSV (PyPI) | | Dart / Flutter | pubspec.yaml | package: imports | OSV (Pub) | | Ruby | Gemfile | require | OSV (RubyGems) | | PHP | composer.json | use statements | OSV (Packagist) | | Java / Kotlin | pom.xml, build.gradle | import statements | OSV (Maven) | | Go | go.mod | import paths | OSV (Go) | | Rust | Cargo.toml | use, extern crate | OSV (crates.io) | | Swift | Package.swift | import | OSV (SwiftURL) | | .NET / C# | *.csproj | using statements | OSV (NuGet) | | C / C++ | CMakeLists.txt, conanfile.txt | #include | OSV (ConanCenter) |

How It Works

Your repo ──> GitHub API ──> Parse manifests ──> Parse source imports
                                                        │
   CVE report <── Health scoring <── OSV queries <──────┘
   with usage    per dependency      per ecosystem
   path mapping

1. Fetches the repository file tree via GitHub API
2. Auto-detects all ecosystems (supports monorepos with multiple)
3. Parses every manifest file to extract dependencies
4. Analyzes up to 200 source files to trace actual import usage
5. Queries OSV.dev for known vulnerabilities per ecosystem
6. Maps CVEs to your specific usage path — not just "package has CVE" but "you call the affected function"
7. Computes health scores and generates actionable suggestions

Also Available As

• VS Code Extension — Inline CVE warnings, sidebar dependency tree, CodeLens above imports
• GitHub Action — Auto-comment on PRs with analysis results
• Web App — Browser-based analysis

License

MIT