Pharos 🏛️

Trace vulnerable JavaScript dependencies through your dependency tree. Like yarn why, but shows the full chain and suggests which parent package to update.

Install

npx pharos-cli <package>@<version>

Or install globally:

npm install -g pharos-cli

Usage

# Check current directory
pharos [email protected]

# Check specific project
pharos [email protected] -p ./my-app

# Search recursively
pharos [email protected] -p ~/projects -r

Options

• -p, --path <PATH> — Directory to search (default: current)
• -r, --recursive — Search subdirectories

Example Output

════════════════════════════════════════════════════════════
📁 ./yarn.lock
════════════════════════════════════════════════════════════
  ✓ Found [email protected]

  ── Chain 1 ──
  [email protected] (requested as 6.13.0)
    → [email protected] (requested as 1.20.3)
    → [email protected] (requested as ^4.18.2)
    → [email protected]

 Fix path:
  body-parser >= 1.20.4
  express >= 5.0.0
  → Recommended: Update express to >= 5.0.0

Limitations

• Only parses yarn.lock files (package-lock.json detection is in place, parsing coming soon)
• Fix suggestions rely on the public npm registry — private packages in the chain may not have upgrade recommendations

License

MIT