endor-check

To check a package for vulnerabilities, specify the dependency name and version to evaluate its safety across compatible ecosystems. The tool identifies known CVEs and malware indicators, returning a risk report with recommended actions.

Yes, you can scan a dependency for malware across common ecosystems including npm, Python, Go, and Ruby. The analysis evaluates the specified package version against known malware indicators and vulnerability databases.

The best way to validate a single package's safety is to run a targeted security check using the package name and version. This evaluates the dependency for known CVEs and malware risks, providing recommended actions before integration.

Dependency vulnerability checking evaluates risks using the ecosystem, dependency name, and version. While specifying a version allows for precise risk evaluation, the tool applies fallback mechanisms to check for vulnerabilities when version data is incomplete.

After identifying malware risks in a dependency, you should review the recommended actions provided in the risk report. These actions guide whether to avoid the package, update to a secure version, or apply mitigations before adding it to your codebase.