A lightweight JavaScript-based dependency scanner that helps prevent vulnerable or blacklisted packages from being pushed to a GitHub repository.
This tool integrates directly with **Git hooks and prep push ** to block unsafe code before it reaches remote repositories.
This script scans your project’s installed dependencies and checks them against a hardcoded list of vulnerable packages.
If a match is found:
- ❌ The Git push is blocked
⚠️ A warning is displayed in the terminal- 🔒 The process exits with a failure code
- Reads
package-lock.json - Iterates through all installed dependencies
- Compares them against a predefined blacklist
- If a vulnerable package/version is found:
- Logs the issue
- Stops the Git push process
This tool is designed to run inside a Git pre-push hook:
At the moment, the scanner is intentionally simple and uses a hardcoded list of vulnerable packages This project is designed to evolve into a full dependency intelligence system. with developments such as Semantic version range checking (^4.0.0, >=1.2.0) , Pattern-based vulnerability detection , Confidence scoring for risk levels , Multi-Lockfile Support , amongst others