DepCheck

A contextual vulnerability scanner for npm projects that shows you which security vulnerabilities actually affect your code.

The Problem

npm audit reports EVERY vulnerability in EVERY dependency. Most vulnerabilities are in code you never use.

The Solution

DepCheck analyzes your actual source code to determine which packages and functions you import, then cross references that against known vulnerabilities from OSV (Open Source Vulnerabilites).

Example

npm audit:

Found 47 vulnerabilities (12 critical, 20 high, 15 moderate)

DepCheck:

SUMMARY: 1 direct dependency needs review, 46 are low priority

Installation

From Source

git clone https://github.com/stev-jz/depcheck.git
cd depcheck
go build -o depcheck main.go
./depcheck scan

Usage

# Run in your npm project directory
cd your-project
depcheck scan

# Show detailed vulnerability information
depcheck scan --verbose

How It Works

1. Parses dependencies - Reads your package.json and package-lock.json
2. Queries vulnerabilities - Checks OSV database for known CVEs
3. Analyzes your code - Uses AST parsing to find what you actually import
4. Contextual assessment - Determines if vulnerabilities affect your code

Output

next@15.3.4
⚠️  NEEDS REVIEW
   You use: [Link NextRequest NextResponse]
   9 vulnerabilities - run with --verbose for details

tar@7.4.3
✓  Low priority (indirect dependency)
   3 vulnerabilities - run with --verbose for details

Supported Projects

• npm (JavaScript/TypeScript)

Tech Stack

• Go (CLI with Cobra)
• OSV API (vulnerability database)
• AST parsing (tdewolff/parse)