npm Vulnerability Scanner
The world's largest software registry with over 2 million packages. npm is the default package manager for Node.js.
Scan your package-lock.json, yarn.lock, pnpm-lock.yaml online
Free dependency vulnerability scan for npm — no signup required
Common npm Risk Types
npm packages are commonly affected by prototype pollution, ReDoS attacks, and supply chain compromises. GeekWala highlights which npm CVEs are actively exploited — not just theoretically vulnerable.
npm Security Guide
How to Scan npm Projects
GeekWala supports the following JavaScript/TypeScript dependency files
Supported Files
package-lock.jsonyarn.lockpnpm-lock.yaml
Scan Methods
- Upload your lockfile
- Paste file contents
- Import from GitHub
What You Get
- Exploitation-ranked results (not just CVSS)
- CISA KEV: flag CVEs actively attacked right now
- EPSS: 30-day exploit probability per CVE
- Cross-ecosystem: cover your full stack in one scan
Compare & learn more
See how results are ranked by exploitation risk — KEV-flagged CVEs first, with EPSS scores.
See a live example102 Known Exploited Vulnerabilities
These vulnerabilities are actively being exploited in the wild. Scan your project to check if you're affected.
Recent npm Vulnerabilities
Latest security issues affecting JavaScript/TypeScript packages
Most Affected npm Packages
Packages with the most known vulnerabilities
Secure Your JavaScript/TypeScript Dependencies
Scan your package.json against OSV. Results are ranked by exploitation probability — CVEs under active attack appear first, so you fix what's actually being exploited, not just what scores highest.