Dependency Vulnerability Scanner
Free, OSV-powered vulnerability scanning across 8 package ecosystems — ranked by exploitation risk with EPSS and CISA KEV, not just CVSS.
Choose Your Ecosystem
Each ecosystem page tracks known vulnerabilities, the most affected packages, and severity trends specific to that language's dependency graph.
npm
JavaScript/TypeScript
The world's largest software registry with over 2 million packages. npm is the default package manager for Node.js.
PyPI
Python
The Python Package Index hosts hundreds of thousands of packages for data science, web development, automation, and more.
Packagist
PHP
The main Composer repository for PHP packages. Powers frameworks like Laravel, Symfony, and thousands of applications.
Maven
Java/Kotlin
Central repository for Java and JVM ecosystem. Maven powers enterprise applications, Android development, and more.
Go Modules
Go
Official dependency management for Go. Secure, fast, and reliable package management built into the Go toolchain.
crates.io
Rust
The Rust community's package registry. Known for memory safety and performance-critical applications.
RubyGems
Ruby
The Ruby community's gem hosting service. Powers Rails applications and Ruby projects worldwide.
NuGet
C#/.NET
The package manager for .NET. Essential for ASP.NET, Blazor, and cross-platform .NET development.
Supported Lockfiles by Ecosystem
GeekWala parses these manifest and lockfile formats directly — upload, paste, or import from GitHub.
| Ecosystem | Manifest File | Lockfiles Parsed | Vulnerabilities |
|---|---|---|---|
| npm | package.json | package-lock.json, yarn.lock, pnpm-lock.yaml | 874 |
| PyPI | requirements.txt | requirements.txt, Pipfile.lock, poetry.lock | 931 |
| Packagist | composer.json | composer.lock | 798 |
| Maven | pom.xml | pom.xml | 788 |
| Go Modules | go.mod | go.sum | 759 |
| crates.io | Cargo.toml | Cargo.lock | 815 |
| RubyGems | Gemfile | Gemfile.lock | 745 |
| NuGet | *.csproj | packages.lock.json | 842 |
How Vulnerability Data Differs by Ecosystem
Every ecosystem GeekWala scans pulls from the same underlying OSV database, but the shape of the risk is different per language. Compiled languages like Go and Rust see fewer supply-chain typosquats but more memory-safety and FFI issues. Dynamically-loaded ecosystems like npm and PyPI see far more prototype-pollution, deserialization, and dependency-confusion attacks because their install-time hooks execute arbitrary code.
That's why each ecosystem page below shows its own risk summary and common vulnerability classes, instead of one generic warning applied to every language.
Every supported ecosystem currently has indexed vulnerability history.
We track 6,552 known vulnerabilities across 8 ecosystems today, cross-referenced against EPSS exploit-prediction scores and the CISA Known Exploited Vulnerabilities catalog so you can prioritize what's actually being attacked.
Scan Every Dependency in One Pass
Upload lockfiles from multiple ecosystems in a single project — results are ranked by exploitation probability so you fix what's actually being exploited first.