[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"tools-page-package-json-vulnerability-scanner":3},{"page":4,"related":402,"variants":422},{"path":5,"name":6,"title":7,"description":8,"checkedAt":9,"sources":10,"faq":62,"related":81,"nuxter":85,"body":88,"tool":400,"preset":401},"\u002Ftools\u002Fpackage-json-vulnerability-scanner","package.json vulnerability scanner","package.json Vulnerability Scanner and npm License Check","Scan a package.json and lockfile against the OSV database for known vulnerabilities and malware, and flag copyleft or missing licenses. Free, in your browser.","2026-10-07",[11,14,17,20,23,26,29,32,35,38,41,44,47,50,53,56,59],{"label":12,"url":13},"OSV API docs, POST \u002Fv1\u002Fquerybatch","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fpost-v1-querybatch\u002F",{"label":15,"url":16},"OSV API docs, GET \u002Fv1\u002Fvulns\u002F{id}","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fget-v1-vulns\u002F",{"label":18,"url":19},"OSV API docs, overview and limits","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fapi\u002F",{"label":21,"url":22},"OSV Go client, batch query limit","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fosv.dev\u002Fblob\u002Fmaster\u002Fbindings\u002Fgo\u002Fosvdev\u002Fosvdev.go",{"label":24,"url":25},"OSV data sources","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fdata\u002F",{"label":27,"url":28},"OSV schema","https:\u002F\u002Fossf.github.io\u002Fosv-schema\u002F",{"label":30,"url":31},"GitHub docs, About the GitHub Advisory Database","https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcode-security\u002Fsecurity-advisories\u002Fworking-with-global-security-advisories-from-the-github-advisory-database\u002Fabout-the-github-advisory-database",{"label":33,"url":34},"FIRST, CVSS v3.1 Specification","https:\u002F\u002Fwww.first.org\u002Fcvss\u002Fv3.1\u002Fspecification-document",{"label":36,"url":37},"npm registry docs, package metadata","https:\u002F\u002Fgithub.com\u002Fnpm\u002Fregistry\u002Fblob\u002Fmain\u002Fdocs\u002Fresponses\u002Fpackage-metadata.md",{"label":39,"url":40},"npm-pick-manifest","https:\u002F\u002Fgithub.com\u002Fnpm\u002Fnpm-pick-manifest",{"label":42,"url":43},"npm docs, package.json license and overrides","https:\u002F\u002Fdocs.npmjs.com\u002Fcli\u002Fv11\u002Fconfiguring-npm\u002Fpackage-json",{"label":45,"url":46},"npm docs, npm audit","https:\u002F\u002Fdocs.npmjs.com\u002Fcli\u002Fv11\u002Fcommands\u002Fnpm-audit",{"label":48,"url":49},"pnpm lockfile spec, version 9.0","https:\u002F\u002Fgithub.com\u002Fpnpm\u002Fspec\u002Fblob\u002Fmaster\u002Flockfile\u002F9.0.md",{"label":51,"url":52},"pnpm docs, lockfile documents","https:\u002F\u002Fpnpm.io\u002Flockfile",{"label":54,"url":55},"SPDX license expressions","https:\u002F\u002Fspdx.github.io\u002Fspdx-spec\u002Fv3.0.1\u002Fannexes\u002Fspdx-license-expressions\u002F",{"label":57,"url":58},"Blue Oak Council, copyleft list","https:\u002F\u002Fblueoakcouncil.org\u002Fcopyleft",{"label":60,"url":61},"Blue Oak Council, permissive license list","https:\u002F\u002Fblueoakcouncil.org\u002Flist",[63,66,69,72,75,78],{"question":64,"answer":65},"Is this the same as npm audit?","No. npm audit posts your dependency tree to your registry's bulk advisory endpoint and, by default, needs a lockfile. This scanner asks the OSV database, which collects advisories from sources including the GitHub Advisory Database and the OpenSSF Malicious Packages repository, and it also works from a package.json alone. npm audit fix goes further and runs an install; this page only reports, and you change versions yourself.",{"question":67,"answer":68},"Do I need to paste a lockfile?","No, but it makes the result exact. Without one, the scanner checks only your direct dependencies, each at the version npm would install today. With package-lock.json or pnpm-lock.yaml it checks every version you installed, including the transitive packages your dependencies pull in.",{"question":70,"answer":71},"Which lockfiles can it read?","package-lock.json in lockfile versions 1 to 3, and pnpm-lock.yaml from version 5 to version 9. It does not read yarn.lock or bun.lock; leave the lockfile empty for those projects and the direct dependencies are still checked.",{"question":73,"answer":74},"Is my package.json uploaded?","Not to us. The files are parsed in your browser and never go into the page address. Only when you press Check packages do the names and versions of your packages go to api.osv.dev and registry.npmjs.org, straight from your browser.",{"question":76,"answer":77},"Which licenses does it flag?","Strong, network and maximal copyleft licenses as the Blue Oak Council groups them, such as the GPL, AGPL and SSPL, plus packages marked UNLICENSED. It notes weak copyleft such as the LGPL and MPL, and asks you to read custom licenses, missing ones and any it cannot place. It sorts licenses so you know what to read first; it is not legal advice.",{"question":79,"answer":80},"How do I fix a vulnerable transitive dependency?","First update the direct dependency that pulls it in, since a newer release often moves to a fixed version. npm explain or pnpm why shows the chain. If no such release exists, force the fixed version with overrides in package.json for npm, or overrides in pnpm-workspace.yaml for pnpm, then run your tests.",[82,83,84],"nuxt-upgrade-checker","cloudflare-workers-compatibility-checker","nuxt-environment-variables",{"body":86,"to":87},"Nuxter's pnpm setup waits seven days before it installs a newly published version and lets only the packages it approves run install scripts, so a hijacked release has time to be caught before it reaches your project.","\u002Ffeatures",{"type":89,"value":90,"toc":393},"minimark",[91,96,113,144,147,151,158,177,180,184,187,209,216,220,250,277,280,284,287,323,330,376,386,389],[92,93,95],"h2",{"id":94},"what-the-scanner-checks","What the scanner checks",[97,98,99,100,104,105,108,109,112],"p",{},"Paste a package.json and the scanner reads its ",[101,102,103],"code",{},"dependencies",", ",[101,106,107],{},"devDependencies"," and ",[101,110,111],{},"optionalDependencies"," in your browser. Nothing leaves the page until you press Check packages. Then it does three things:",[114,115,116,128,138],"ol",{},[117,118,119,123,124,127],"li",{},[120,121,122],"strong",{},"Pins a version for each direct dependency."," With a lockfile, that is the version you installed. Without one, it asks the npm registry for the package's versions and picks the one npm would install today: the ",[101,125,126],{},"latest"," tag when your range allows it, otherwise the highest matching version that is not deprecated.",[117,129,130,133,134,137],{},[120,131,132],{},"Asks OSV about every package version"," in batches, through its ",[101,135,136],{},"querybatch"," endpoint, with the ecosystem set to npm.",[117,139,140,143],{},[120,141,142],{},"Loads each advisory OSV returns",": its severity, summary, affected ranges, fixed versions and aliases, with a link to the full record on osv.dev.",[97,145,146],{},"It also reads each direct dependency's manifest on npm for its license. The numbers it relies on, from the severity scale to OSV's limits, are in the table further down.",[92,148,150],{"id":149},"why-the-lockfile-matters","Why the lockfile matters",[97,152,153,154,157],{},"A range such as ",[101,155,156],{},"^4.17.0"," allows every 4.x release from 4.17.0 up, so the package.json alone cannot say what you run. The lockfile can. It records the exact version of every package in the install, including the dependencies of your dependencies.",[97,159,160,161,164,165,168,169,172,173,176],{},"The scanner reads ",[101,162,163],{},"package-lock.json"," from npm, in lockfile versions 1 to 3, and ",[101,166,167],{},"pnpm-lock.yaml"," from version 5 to version 9. For pnpm it reads the keys of every ",[101,170,171],{},"packages"," section, such as ",[101,174,175],{},"vue@3.5.13",", and drops the peer suffix pnpm adds in parentheses. That includes the first document pnpm writes into the same file for config dependencies and its own version, which a scanner reading only one document would miss. Entries that name no registry version, such as git, file and link dependencies, are counted and skipped.",[97,178,179],{},"Without a lockfile, a clean result says only that today's versions of your direct dependencies have no known advisory. Run it again with the lockfile before you trust it.",[92,181,183],{"id":182},"how-severity-is-read","How severity is read",[97,185,186],{},"OSV records come from several databases, and the scanner reads their severity in this order:",[114,188,189,200,203,206],{},[117,190,191,192,195,196,199],{},"A record from the OpenSSF Malicious Packages repository, with an ID starting ",[101,193,194],{},"MAL-",", is ",[120,197,198],{},"malicious",". There is no safe version of a malicious package; remove it.",[117,201,202],{},"A record from the GitHub Advisory Database carries GitHub's own rating, which the scanner shows as written: Critical, High, Moderate or Low.",[117,204,205],{},"A record with only a CVSS v3 vector gets its base score from the CVSS v3.1 equations and the rating that score falls in.",[117,207,208],{},"Anything else shows as unrated. Open it on osv.dev to judge it yourself.",[97,210,211,212,215],{},"Where a record has a CVSS v3 vector, its base score appears beside the rating. GitHub's reviewers can rate an advisory outside its score's band, as with express's ",[101,213,214],{},"res.redirect"," XSS, rated Low with a base score of 5.0, so the two can disagree. A base score describes the flaw itself, not whether your code reaches it, so read the summary before you decide how fast to move.",[92,217,219],{"id":218},"how-licenses-are-sorted","How licenses are sorted",[97,221,222,223,226,227,230,231,234,235,238,239,242,243,245,246,249],{},"npm's ",[101,224,225],{},"license"," field holds an SPDX expression such as ",[101,228,229],{},"MIT"," or ",[101,232,233],{},"(MIT OR GPL-3.0-or-later)",", a pointer such as ",[101,236,237],{},"SEE LICENSE IN LICENSE.md",", or ",[101,240,241],{},"UNLICENSED"," for a package that grants no rights to use it. Older packages use a ",[101,244,225],{}," object or a ",[101,247,248],{},"licenses"," array, which the scanner also reads.",[97,251,252,253,256,257,260,261,264,265,268,269,272,273,276],{},"Each license ID is matched against the Blue Oak Council's permissive list and its copyleft list, which groups copyleft licenses into weak, strong, network and maximal families. In an expression, ",[101,254,255],{},"OR"," gives you the choice, so the most permissive option counts; ",[101,258,259],{},"AND"," binds you to both, so the most restrictive one counts. Deprecated IDs such as ",[101,262,263],{},"GPL-2.0"," read as ",[101,266,267],{},"GPL-2.0-only",", and ",[101,270,271],{},"GPL-2.0+"," as ",[101,274,275],{},"GPL-2.0-or-later",".",[97,278,279],{},"The check covers direct dependencies only, at the version that was checked. A family tells you what to read first, not what you may do. Whether a license fits depends on how you ship, so ask a lawyer when it matters.",[92,281,283],{"id":282},"when-a-package-is-vulnerable","When a package is vulnerable",[97,285,286],{},"Start with the advisory's fix line. When a fixed version is published, update the direct dependency, or the one that pulls the package in, to a release that uses it:",[288,289,294],"pre",{"className":290,"code":291,"language":292,"meta":293,"style":293},"language-sh shiki shiki-themes github-light github-light github-dark","npm explain minimist\npnpm why minimist\n","sh","",[101,295,296,312],{"__ignoreMap":293},[297,298,301,305,309],"span",{"class":299,"line":300},"line",1,[297,302,304],{"class":303},"snPdu","npm",[297,306,308],{"class":307},"sIIMD"," explain",[297,310,311],{"class":307}," minimist\n",[297,313,315,318,321],{"class":299,"line":314},2,[297,316,317],{"class":303},"pnpm",[297,319,320],{"class":307}," why",[297,322,311],{"class":307},[97,324,325,326,329],{},"When no release of the parent has moved yet, you can force the fixed version for the whole tree. npm reads ",[101,327,328],{},"overrides"," from package.json:",[288,331,335],{"className":332,"code":333,"language":334,"meta":293,"style":293},"language-json shiki shiki-themes github-light github-light github-dark","{\n  \"overrides\": {\n    \"minimist\": \"1.2.8\"\n  }\n}\n","json",[101,336,337,343,352,364,370],{"__ignoreMap":293},[297,338,339],{"class":299,"line":300},[297,340,342],{"class":341},"sxrX7","{\n",[297,344,345,349],{"class":299,"line":314},[297,346,348],{"class":347},"sBjJW","  \"overrides\"",[297,350,351],{"class":341},": {\n",[297,353,355,358,361],{"class":299,"line":354},3,[297,356,357],{"class":347},"    \"minimist\"",[297,359,360],{"class":341},": ",[297,362,363],{"class":307},"\"1.2.8\"\n",[297,365,367],{"class":299,"line":366},4,[297,368,369],{"class":341},"  }\n",[297,371,373],{"class":299,"line":372},5,[297,374,375],{"class":341},"}\n",[97,377,378,379,381,382,385],{},"pnpm reads ",[101,380,328],{}," from ",[101,383,384],{},"pnpm-workspace.yaml",". Either way, run your tests after, because the parent package was never tested against the version you forced.",[97,387,388],{},"A clean result is not a guarantee. OSV lists problems someone has found and reported, so scan again when you add a dependency and before each release.",[390,391,392],"style",{},"html pre.shiki code .snPdu, html code.shiki .snPdu{--shiki-light:#6F42C1;--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sIIMD, html code.shiki .sIIMD{--shiki-light:#032F62;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sxrX7, html code.shiki .sxrX7{--shiki-light:#24292E;--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sBjJW, html code.shiki .sBjJW{--shiki-light:#005CC5;--shiki-default:#005CC5;--shiki-dark:#79B8FF}",{"title":293,"searchDepth":314,"depth":314,"links":394},[395,396,397,398,399],{"id":94,"depth":314,"text":95},{"id":149,"depth":314,"text":150},{"id":182,"depth":314,"text":183},{"id":218,"depth":314,"text":219},{"id":282,"depth":314,"text":283},"package-json-vulnerability-scanner",null,[403,410,416],{"path":404,"tool":82,"name":405,"title":406,"description":407,"summary":408,"checkedAt":409},"\u002Ftools\u002Fnuxt-upgrade-checker","Nuxt upgrade checker","Nuxt 3 to 4 Migration Checker for Modules and Config","Plan a Nuxt 3 to 4 migration. Paste package.json to see which modules declare Nuxt 4 or 5, which nuxt.config options break, and the official checklist.","Paste a package.json to see which modules declare Nuxt 4 or 5, which config options break, and the official checklist.","2026-10-06",{"path":411,"tool":83,"name":412,"title":413,"description":414,"summary":415,"checkedAt":409},"\u002Ftools\u002Fcloudflare-workers-compatibility-checker","Workers compatibility checker","Cloudflare Workers Compatibility Checker for npm","Check which npm packages run on Cloudflare Workers, which need nodejs_compat and which will not run, then copy the compatibility_date and flags.","Paste a package.json to see which packages run on Workers, need nodejs_compat or will not run, with the wrangler settings.",{"path":417,"tool":84,"name":418,"title":419,"description":420,"summary":421,"checkedAt":409},"\u002Ftools\u002Fnuxt-environment-variables","Nuxt environment variables","Nuxt Environment Variables: runtimeConfig to NUXT_","Paste a nuxt.config to get the Nuxt environment variables that override each runtimeConfig key, the type each value arrives as and the names that collide.","Paste a nuxt.config and get the NUXT_ variable for every runtimeConfig key, the type it arrives as and the names that collide.",[]]