🔒 Dep Inspector

A TypeScript CLI tool that scans your project folders for vulnerable packages and suggests safe alternatives.

Features

• ✅ Scans recursively — finds package.json, requirements.txt, go.mod, Cargo.toml, Gemfile, composer.json
• ✅ Multi-ecosystem — npm, pip, Go, Cargo, RubyGems, Composer
• ✅ OSV.dev integration — checks against Google's Open Source Vulnerabilities database
• ✅ Severity rating — CRITICAL, HIGH, MODERATE, LOW
• ✅ Fix suggestions — suggests upgrade versions when available
• ✅ Alternative packages — curates known safe alternatives for compromised packages
• ✅ Typosquatting detection — warns about malicious lookalike packages
• ✅ JSON report export — for CI/CD integration
• ✅ Parallel scanning — configurable concurrency

Quick Start

# Scan current directory
node dist/index.js

# Scan a specific project
node dist/index.js /path/to/project

# Limit scan depth
node dist/index.js --depth 3

Example Output

╔══════════════════════════════════════════════════════════════════════╗
║              🔒 Dependency Vulnerability Report                    ║
╚══════════════════════════════════════════════════════════════════════╝

  Scanned:     /home/user/project
  Manifestos:   3 files
  Packages:    47 dependencies

  Found 8 vulnerabilities:

┌──────────┬────────────────────┬────────────────────┬────────────┬─────────────────┐
│ Severity │ ID                 │ Package            │ Fix        │ Description      │
├──────────┼────────────────────┼────────────────────┼────────────┼─────────────────┤
│ CRITICAL │ GHSA-xxxx-xxxx-xx  │ lodash             │ → 4.17.21  │ Prototype poll.. │
│ HIGH     │ CVE-2024-xxxx      │ axios              │ → 1.6.0    │ SSRF vulnerab..  │
└──────────┴────────────────────┴────────────────────┴────────────┴─────────────────┘

  📊 Summary:
       CRITICAL: 1
       HIGH:     7

  💡 Suggested Alternatives:
    ✗ lodash → Native Array/Object methods (ES2024+)
    ✗ moment → date-fns, dayjs, luxon (deprecated)

Options

| Option | Alias | Default | Description | |---|---|---|---| | [directory] | | . | Directory to scan | | --output <path> | -o | ./reports | Output directory for JSON | | --depth <n> | -d | 5 | Maximum directory depth | | --concurrency <n> | -c | 5 | Concurrent API checks | | --json-only | | false | JSON only, no terminal table | | --help | -h | | Show help |

Vulnerability Databases Used

• OSV.dev (Google) — Unified vulnerability database for open source
• Curated database — Known malicious/compromised packages with alternatives
• Typosquatting patterns — Detects common package name misspellings

Exit Codes

| Code | Meaning | |---|---| | 0 | No critical vulnerabilities found | | 1 | Critical vulnerabilities detected |