depScanner

depScanner is a lightweight and efficient dependency scanner tool that analyzes lock files (e.g., package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock) and package.json for vulnerabilities. Built with Rust, it helps developers ensure their dependencies are secure and up-to-date.

---

Features

• Scans lock files for exact dependency versions.
• Supports multiple formats:
  • package-lock.json (npm)
  • yarn.lock (Yarn)
  • pnpm-lock.yaml (pnpm v5/v6+)
  • bun.lock (Bun text lockfile)
  • Fallback to package.json (or any .json that isn’t a lockfile).
• Identifies known vulnerabilities via the OSV API (npm ecosystem).
• Provides a clean, CLI-friendly vulnerability report.
• Fast and memory-efficient, powered by Rust.

---

Getting Started

To use depScanner, choose one of the following methods:

Using Rust Locally

If you want to run depScanner natively on your machine, follow these steps:

1. Ensure you have Rust installed.

2. Clone the repository:

   git clone https://github.com/your-username/depScanner.git
   cd depScanner

3. Build the project:

   cargo build --release

4. Run the binary:

   ./target/release/depScanner <path-to-lockfile-or-package.json>

Using Docker (Recommended)

For a hassle-free setup, use the Docker image to run depScanner:

1. Build the Docker image:

   docker build -t dep-scanner .

2. Run the Docker container:

   docker run --rm -v $(pwd):/app dep-scanner ./depScanner /app/<lock-file-or-package.json>

   Replace <lock-file-or-package.json> with the path to your dependency file.

---

Usage

Basic Command

Scan a lock file or package.json:

./depScanner <path-to-lockfile-or-package.json>

Examples

1. Scan a package-lock.json file:

   ./depScanner ./package-lock.json

2. Scan a yarn.lock file:

   ./depScanner ./yarn.lock

3. Scan a pnpm-lock.yaml file:

   ./depScanner ./pnpm-lock.yaml

4. Scan a Bun text lockfile:

   ./depScanner ./bun.lock

5. Fallback to package.json (or any dependency JSON) if lock files are unavailable:

   ./depScanner ./package.json

6. Using Docker to scan a file:

   docker run --rm -v $(pwd):/app dep-scanner ./depScanner /app/package-lock.json

---

Output

The CLI displays a vulnerability report like this. In a real terminal, vulnerable package lines and the “Vulnerable dependencies” count are shown in red; safe package lines and the “Safe dependencies” count are in green. The sample below is plain text (Markdown can’t show ANSI colors):

Dependency Vulnerability Report
Package                        Version         Issues
--------------------------------------------------------------------------------
lodash                         4.17.19        GHSA-29mw-wpgm-hmr9; GHSA-35jh-r3h4-6jhm
minimist                       1.2.0          GHSA-vh95-rmgr-6w4m; GHSA-xvch-5gv4-984h
chalk                          2.4.2          No issues found

• Red: Vulnerable dependencies (advisory IDs shown).
• Green: No vulnerabilities found.

---

Supported Formats

Format	Manager	Notes
package-lock.json	npm	Top-level dependencies with version.
yarn.lock	Yarn	One-line "pkg@range": version "x.y.z" style.
pnpm-lock.yaml	pnpm	Both legacy dependencies and v6+ packages (e.g. /name@version).
bun.lock	Bun	Text/JSON lockfile (use bun install --save-text-lockfile; binary bun.lockb is not supported).
package.json	—	Fallback: any .json that isn’t a lockfile is parsed as package.json.

Test fixtures for all formats live in fixtures/; run ./scripts/test-fixtures.sh to scan them all.

---

License

This project is licensed under the MIT License.

---

Acknowledgments

• Built with ❤️ using Rust.
• Inspired by the need for secure dependency management.

---