Scan Dependencies for Vulnerabilities

Dependency Vulnerability Scanning is a security skill for multi-ecosystem dependency vulnerability analysis, SBOM generation and supply-chain security, with automated remediation strategies.

Its DependencyScanner detects which ecosystems a project uses by scanning for manifest files - npm (package.json/package-lock.json), pip (requirements.txt/pyproject.toml), go (go.mod) and cargo (Cargo.toml) - then runs the matching scanner: npm audit --json for npm, parsing each vulnerability's name, severity, CVEs and available fix; safety check --json for Python; govulncheck -json ./... for Go; and cargo audit --json for Rust, each mapped into a common vulnerability record (package, version, vulnerability ID, severity, fixed version, source). Results are tallied into a summary of total/critical/high/medium/low counts.

Vulnerability prioritization computes a numeric score as cvss_score * 0.4 + exploitability * 2.0 + fix_available * 1.0, where exploitability is 1.0 if an exploit is known to be available and 0.5 otherwise, and fix_available is 1.0 if a fixed version exists and 0.3 otherwise - then sorts vulnerabilities by that score descending, so exploitable, fixable, high-CVSS issues surface first regardless of severity label alone.

A remediation plan lists the top 20 critical/high vulnerabilities as immediate actions (package, current version, fixed version, severity, priority) and gives ecosystem-specific automation commands:

npm audit fix && npm update

Equivalent commands are given for pip (pip-audit --fix && safety check), Go (go get -u ./... && go mod tidy) and Rust (cargo update && cargo audit). An SBOM is generated in CycloneDX 1.5 format, listing the vulnerable packages found in each ecosystem as library components with their name, version and package URL (pkg:<ecosystem>/<name>@<version>).

Its CI/CD integration example is a GitHub Actions workflow triggered on push to main and a nightly cron, running a matrix job per ecosystem (npm, python, go) that installs dependencies, runs the ecosystem's scanner with JSON output, uploads the results as an artifact, and fails the job if any critical-severity finding is present in the uploaded JSON.

An automated-dependency-update.sh script takes an ecosystem and an update type (patch or minor) as arguments and runs the ecosystem-appropriate flow: for npm, npm audit --audit-level=moderate, then npm update --save for patch or npx npm-check-updates -u --target minor for minor, followed by npm test and a re-audit; for Python, pip-audit --fix, safety check and pytest; for Go, go get -u ./..., go mod tidy, govulncheck ./... and go test ./.... A VulnerabilityReporter class generates a Markdown report with an executive summary of total/critical/high/medium/low counts and a detailed section per critical or high finding (package, severity, current version, fixed-in version, CVE list), and can also emit results as a SARIF 2.1.0 document with severity mapped to SARIF levels.

Use it for auditing dependencies for vulnerabilities or license risks, generating SBOMs for compliance or supply-chain visibility, planning remediation for outdated or vulnerable packages, or standardizing dependency scanning across ecosystems. Do not use it when you only need runtime security testing, when there is no dependency manifest or lockfile, or when the environment blocks running security scanners. Its safety notes: avoid running auto-fix or upgrade steps without approval, and treat dependency changes as release-impacting, testing them accordingly.

Input is $ARGUMENTS describing the scan scope, plus the project's dependency manifests and lockfiles. Output is a per-ecosystem vulnerability list with severity counts, a priority-scored remediation plan with immediate actions and per-ecosystem fix commands, and a CycloneDX SBOM.

It integrates with npm audit, Python's safety and pip-audit, Go's govulncheck, Rust's cargo audit, and GitHub Actions for scheduled and push-triggered CI scanning with artifact upload.

It suits engineering and security teams that need repeatable, multi-ecosystem dependency scanning with a prioritized, actionable remediation plan and a CycloneDX SBOM rather than a single-language, one-off audit.