Vulnerability Checker
Analizza package.json o requirements.txt per vulnerabilita' note nelle dipendenze.
File delle Dipendenze
Database: 50 CVE note per top pacchetti npm/Python (lodash, axios, express, moment...). Solo analisi offline, nessun dato inviato.
Come utilizzare Vulnerability Checker
Attach dependency file
Copy content from your package.json (npm/yarn) or requirements.txt (Python) into the textarea, or click "Load Example" to try the tool with sample data.
Click "Analyze Vulnerability
Tool extracts package name and version (dependencies and devDependencies for npm) and compares them with the internal CVE database notes.
Read results by severity.
Vulnerabilities found are ordered from Critical to Low, with CVE ID, description, and minimum secure version to update.
Copy Report
Use "Copy Report" to export scanned package and vulnerability data in Markdown format found, useful for issues or PRs.
Suggerimenti
- Run a check before every release: attach the updated package.json to intercept vulnerable dependencies introduced by new packages.
- Use "Copy Report" to attach the list of vulnerabilities found directly in an issue or pull request for remediation.
- If a vulnerability is reported, always update to the fixed version or higher, then check for any breaking changes in the package's changelog.
Domande frequenti
What files can I analyze with this tool?
You can paste a package.json file (Node.js/npm, analyzes both dependencies and devDependencies) or a requirements.txt file (Python, with syntax like package>=version or package==version). The format is automatically recognized based on its content.
What is the basis for vulnerability control?
The tool compares the installed version of each package with an internal database of around 50 widely noted CVEs related to popular npm/Python packages (lodash, axios, express, moment, and others). If the installed version is lower than the patched version, a vulnerability is reported.
Are my data being sent to a server?
No. Analysis is entirely client-side in the browser: the content of the attached file does not leave your device and is not saved anywhere.
Does this tool replace npm audit or tools like Snyk/Dependabot?
No. Our internal database covers a limited set of CVE for popular packages and is designed for quick offline checks. For a full audit and continuously updated use npm audit, GitHub Dependabot or dedicated tools like Snyk, which query real-time CVE databases.
What does "no vulnerability found" mean?
Means that none of the packages analyzed match any of the CVEs present in the internal tool's database, not that the project is completely free from vulnerabilities. The database is a deliberately limited subset of known CVEs, not an exhaustive source.