outdated-deps

To scan project dependencies for known vulnerabilities, this Skill analyzes manifests and lockfiles across multiple ecosystems like Node.js and Python to detect known CVEs and supply chain risks. It integrates with external scanners like npm audit, pip-audit, trivy, and osv-scanner to identify security issues.

The best way to audit npm dependencies for unpinned versions and abandoned packages is to analyze manifest and lockfile hygiene. This Skill identifies configuration weaknesses like missing lockfiles and abandoned packages to reduce supply chain security risks before deployment.

Dependency vulnerability scanning works with Python, Rust, Go, Java, and Node.js projects. The Skill supports multiple ecosystems by integrating with external scanners like pip-audit for Python and trivy for broader coverage to detect known CVEs.

To check for typosquatting risks in your software supply chain, the Skill analyzes project dependencies and configuration hygiene. It detects typosquatting risks alongside abandoned packages and unpinned versions to prevent potential breaches and ensure integrity.

Yes, you can use trivy and osv-scanner to detect CVEs in lockfiles. This Skill integrates with external scanners like trivy and osv-scanner to analyze lockfile hygiene and identify known vulnerabilities across various ecosystems.

You should audit lockfile hygiene before deploying a web application to ensure no critical CVEs are present in production. Analyzing lockfiles for unpinned versions and missing dependencies prevents potential breaches and secures the software supply chain.