DepScout

DepScout checks open-source packages against live vulnerability and malware data, so answers about whether a package is safe, and which version to use, come from current advisories instead of model memory.

What it does:

• Checks one package (npm, PyPI, Go, Maven, crates.io or NuGet) at a given version or its latest release. It flags malicious packages and compromised releases first, then lists known vulnerabilities with severity, CVE IDs and the version that fixes each one, plus the minimum version that clears them all.
• Reports the latest stable version, whether a version is outdated or deprecated, the last release date, licences, and the source repository's OpenSSF Scorecard.
• Audits a whole lockfile in one call, including transitive dependencies: package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, Cargo.lock, go.sum, go.mod, packages.lock.json or gradle.lockfile (up to 3,000 packages). Only the packages with problems come back, each with an upgrade target.
• Checks a short list of pinned dependencies (up to 50) when you don't have the lockfile.
• Explains a single advisory by ID (CVE, GHSA, PYSEC, GO, RUSTSEC or MAL): severity, affected and fixed version ranges, and references.
• Ready-made prompts: "Audit my dependencies", "Is this package safe?" and "Explain a CVE".

Who it's for: developers using Claude, Claude Code or other AI assistants who want to vet a dependency before installing it, audit a project's lockfile, or pick a safe version.

Limitations: data comes from OSV.dev and deps.dev. A clean result means no known advisory for that exact version, not a guarantee of safety, and newly published malware may not be listed yet. A plain package list or package.json covers only the packages named in it; a lockfile covers transitive dependencies. DepScout is read-only, does not store the files you send, and is not affiliated with OSV.dev, deps.dev, Google, the OpenSSF, GitHub or any package registry.