skills.rest
freedomw1987
freedomw1987COMMUNITY
Explore all skills by this author →
𝕏@davidaasmGitHub

dependency-cve-audit

Audit JavaScript/TypeScript dependencies for critical and high severity CVEs.

2|Updated May 10, 2026
Search Tags:#devops#vulnerability-remediation#dependency-security#osv-scanner#cve-audit#lockfile-management#red-line-18
One-click install
npx skills add https://github.com/freedomw1987/tree_monstor --skill dependency-cve-audit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependency-cve-audit
Source: https://github.com/freedomw1987/tree_monstor/tree/main/skills/devops/dependency-cve-audit
Command: npx skills add https://github.com/freedomw1987/tree_monstor --skill dependency-cve-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill eliminates the risk of blocked merges and releases caused by critical or high severity CVE vulnerabilities in project dependencies, especially for teams using Bun, npm, or monorepos where standard audit tools fail to work correctly. It also avoids wasted effort from false positive CVE results caused by stale lockfiles, and provides clear migration paths for unmaintained packages with no available security fixes.

Core Features & Use Cases

  • Cross-ecosystem CVE scanning: Supports npm, Bun, Yarn, and pnpm projects, including monorepos with multiple lockfiles, using osv-scanner to read all common lockfile formats.
  • Stale audit result detection: Includes guardrails to identify false positive CVEs from outdated lockfiles, avoiding unnecessary migration work.
  • Unmaintained package remediation: Provides step-by-step migration guidance for packages with no available security fixes, including code rewrite examples and verification steps.
  • Transitive dependency fixes: Teaches how to use package.json overrides to fix vulnerabilities in indirect dependencies without polluting root dependency lists.
  • Use Case: A team using Bun for their backend and npm for their frontend can run a full pre-merge CVE audit, catch a high severity vulnerability in an unmaintained xlsx package, migrate to exceljs, and pass their red line 18 security requirement to ship code.

Quick Start

Use the dependency-cve-audit skill to run a full CVE scan of your project's dependencies, resolve any critical or high severity vulnerabilities including stale lockfile false positives and unmaintained package migrations, and meet your team's pre-merge security requirements.

Frequently Asked Questions about dependency-cve-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit npm and Bun dependencies for critical CVEs before merging?▼

To audit npm and Bun dependencies for CVEs before merging, you can use osv-scanner to read all common lockfile formats and enforce a zero critical/high vulnerability security policy pre-merge.

What is the best way to fix high severity vulnerabilities in unmaintained npm packages?▼

Fixing high severity vulnerabilities in unmaintained npm packages requires step-by-step migration guidance, including code rewrite examples and verification steps to transition to actively maintained alternatives.

Why does my dependency CVE audit show false positive vulnerabilities?▼

A dependency CVE audit may show false positive vulnerabilities when reading stale lockfiles, requiring guardrails to detect outdated lockfiles and avoid unnecessary migration work.

Can I run a CVE audit on a monorepo with multiple lockfiles using Yarn and pnpm?▼

Yes, you can run a CVE audit on a monorepo with multiple lockfiles using Yarn and pnpm, because cross-ecosystem scanning with osv-scanner supports reading all common lockfile formats.

How do I fix transitive dependency vulnerabilities without polluting the root package.json?▼

Fix transitive dependency vulnerabilities without polluting the root package.json by using package.json overrides to patch indirect dependencies identified during the CVE audit.

Does stale lockfile management require regeneration before running a security audit?▼

Stale lockfile management requires regeneration before running a security audit to ensure accurate vulnerability detection and prevent false positive CVE results from outdated dependency trees.

Related Skills

Explore More Software Engineering Skills→
jhaugajhauga

typescript-package-manager

Compare npm, yarn, pnpm, and bun for JavaScript package management.

Community
Advanced
jaskaranhundaljaskaranhundal
3

devsecops-pipeline

Analyze CI/CD security findings and recommend gate actions and remediation steps.

Community
Advanced
UiPathUiPath
18

fix-security-vulnerabilities

Trace transitive dependencies and apply validated fixes for npm and pnpm vulnerabilities.

Official
Advanced
florianbuetowflorianbuetow
12

outdated-deps

Scan project dependencies for CVEs, unpinned versions, and typosquatting risks.

Community
Advanced