Pharos 🏛️

Trace vulnerable JavaScript dependencies through your dependency tree. Like yarn why, but shows the full chain and suggests which parent package to update.

Install

npx pharos-cli <package>@<version>

Or install globally:

npm install -g pharos-cli

Usage

# Check current directory
pharos [email protected]

# Check specific project
pharos [email protected] -p ./my-app

# Search recursively
pharos [email protected] -p ~/projects -r

Options

• -p, --path <PATH> — Directory to search (default: current)
• -r, --recursive — Search subdirectories

Example Output

════════════════════════════════════════════════════════════
📁 ./yarn.lock
════════════════════════════════════════════════════════════
  ✓ Found [email protected]

  ── Chain 1 ──
  [email protected] (requested as ^1.2.5) -> [email protected] -> [email protected]

  Fix path:
    mkdirp >= 1.0.5
    → Recommended: Update mkdirp to >= 1.0.5

Limitations

• Only supports yarn.lock (npm/pnpm coming soon)
• Public npm registry only

License

MIT