Dependency Checker

OSV.dev — the open, aggregated vulnerability database Google maintains, pulling from GitHub Security Advisories (GHSA), the npm registry advisory database, and more. It's the same underlying data source `npm audit` and GitHub Dependabot use.

package-lock.json if you have it — it records the exact resolved version of every dependency, so the vulnerability match is precise. package.json only has version ranges (like ^4.18.2), so this tool has to approximate the installed version by stripping the range prefix, which can be wrong if a newer patch version was actually installed.

It's computed directly from the CVSS v3.1 vector OSV.dev reports for each vulnerability, using the real published FIRST.org scoring formula — not a rounded-off severity label. "Exploitability" reflects how easy the vulnerability is to trigger (remote, no auth, no user interaction needed = High) independent of how severe the impact is.

It means OSV.dev has no recorded advisory for that exact package name and version at the time of the scan. It doesn't mean the package has been independently audited for undiscovered vulnerabilities — only that nothing known and disclosed currently matches.

A Software Bill of Materials is a formal, machine-readable inventory of every component in your application — the same idea as a food ingredient label. Some enterprise customers and government contracts now require one. This tool generates a minimal but spec-valid CycloneDX 1.5 SBOM from whatever manifest you paste.