Dependency & Supply Chain Audit
dependency-supply-chain · v1.1.0 · paid
Third-party dependency assessment covering security vulnerabilities, maintenance health, and license compliance.
Security Vulnerabilities
security-vulns · weight 0.35
- criticalNo known critical CVEs in production dependenciesab-000949
- highNo known high-severity CVEs in production dependenciesab-000950
- highLock file is committed and currentab-000951
- highPostinstall scripts are reviewed and safeab-000952
- criticalNo packages removed from the npm registry (unpublished)ab-000953
- mediumNo obvious typosquatting packagesab-000954
Maintenance & Health
maintenance · weight 0.25
- mediumNo dependencies with no maintainer activity in 2+ yearsab-000955
- highNo deprecated packages in dependenciesab-000956
- mediumNo packages with fewer than 50 weekly downloadsab-000957
- mediumNo wildcard or excessively loose version rangesab-000958
- lowDirect dependencies are on current major versionsab-000959
License Compliance
license · weight 0.2
Optimization
optimization · weight 0.2
- mediumTotal dependency count is reasonable for project sizeab-000964
- lowNo unnecessarily large packages where lighter alternatives existab-000965
- lowNo duplicate packages at conflicting versionsab-000966
- lowDependencies are imported efficientlyab-000967
- highNo dev dependencies serving production runtime rolesab-000968
- infoUnused dependencies are identifiedab-000969
- infoBundle impact of significant new dependencies is evaluatedab-000970