How to scan npm dependencies for vulnerabilities

A complete guide to finding and fixing CVEs in your Node.js package.json using the free npm vulnerability scanner.

Why scan your npm dependencies?

npm packages can contain known vulnerabilities (CVEs) that attackers can exploit. The average Node.js project has 700+ transitive dependencies, and new CVEs are published daily. Scanning your package.json regularly is essential for application security. The npm vulnerability scanner makes this free, fast, and requires no account.

Method 1: Use the web UI (no install)

1. Open the npm vulnerability scanner
2. Paste your package.json content into the textarea
3. Click Scan for Vulnerabilities
4. Review the results — each vulnerability shows severity, CVE ID, and a copy-and-run fix command
5. Click Copy on the one-command fix to upgrade all vulnerable packages at once
6. Optionally download an SBOM (SPDX or CycloneDX) for compliance

Method 2: Use the CLI

# Scan your local package.json
bunx --bun github:sudaisalamboy/npm-vulnerability-scanner bin/scan.ts ./package.json

# JSON output for CI
bunx --bun github:sudaisalamboy/npm-vulnerability-scanner bin/scan.ts ./package.json --json

# Generate SBOM
bunx --bun github:sudaisalamboy/npm-vulnerability-scanner bin/scan.ts ./package.json --sbom cyclonedx > sbom.json

# Fail on high-severity vulns
bunx --bun github:sudaisalamboy/npm-vulnerability-scanner bin/scan.ts ./package.json --fail-on high

Method 3: Add to GitHub Actions (CI/CD)

Add this to .github/workflows/security-scan.yml in any repo:

name: Security Scan
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: sudaisalamboy/npm-vulnerability-scanner@v1
        with:
          package-json: ./package.json
          fail-on: high
          sbom: cyclonedx

Understanding the results

Severity levels

• Critical — remote code execution, SQL injection, authentication bypass. Fix immediately.
• High — significant security impact. Fix before next release.
• Medium — moderate impact. Fix soon.
• Low — minimal impact or requires specific conditions. Can defer.

The one-command fix

The npm vulnerability scanner analyzes every vulnerability and generates a single npm install command that upgrades every fixable package at once. This is the fastest way to resolve all your CVEs in one step.

How the npm vulnerability scanner works

The scanner queries OSV.dev — a free, open-source vulnerability database maintained by Google. OSV.dev aggregates CVEs from the npm advisory database, GitHub Security Advisories (GHSA), and other sources. The scanner never uploads your code — it only queries package names and versions.

Frequently asked questions

Is the npm vulnerability scanner free?

Yes — 100% free and MIT-licensed. No API key, no account, no rate limits beyond OSV.dev's generous limits.

Does it scan devDependencies?

Yes. The scanner scans both dependencies and devDependencies from your package.json.

Does it scan transitive dependencies?

The scanner scans the direct dependencies listed in package.json. For transitive (nested) dependency scanning, use npm ls or run the scanner after npm install against your lockfile.

What SBOM formats are supported?

SPDX 2.3 and CycloneDX 1.4 — both industry standards for Software Bills of Materials.

← Back to npm vulnerability scanner