CVE Dependency Audit

Automatically scan your project's dependencies and identify known Common Vulnerabilities and Exposures (CVEs). Supports Node.js, Python, Ruby, Go, and Maven projects.

Quick Start

# Scan current directory
npx tsx scripts/audit.ts

# Scan specific directory
npx tsx scripts/audit.ts /path/to/project

# Only show critical vulnerabilities
npx tsx scripts/audit.ts --severity critical

# Get fresh data (bypass cache)
npx tsx scripts/audit.ts --no-cache

# Output as JSON
npx tsx scripts/audit.ts --json

Run from the cve-search plugin directory: ~/.claude/plugins/cache/cve-search/

Usage

npx tsx scripts/audit.ts [directory] [options]

Options

Supported Package Managers

The skill automatically detects and parses dependency files from multiple ecosystems:

Node.js / npm

• •File: package.json
• •Detects: dependencies, devDependencies, peerDependencies
• •Example: "express": "^4.18.0"

Python / pip

• •File: requirements.txt
• •Detects: Pinned versions and ranges
• •Example: django==3.2.10 or requests>=2.25.0

Ruby / Bundler

• •File: Gemfile
• •Detects: Gem dependencies with versions
• •Example: gem 'rails', '~> 6.1.0'

Go / Go Modules

• •File: go.mod
• •Detects: Direct and indirect dependencies
• •Example: require github.com/user/repo v1.2.3

Java / Maven

• •File: pom.xml
• •Detects: Project and transitive dependencies
• •Example: <artifactId>log4j-core</artifactId>

How It Works

1. •Discovery: Scans for supported dependency files in the directory
2. •Parsing: Extracts package names and versions from each file
3. •Searching: Queries CVE database for each dependency
4. •Filtering: Identifies which vulnerabilities affect installed versions
5. •Reporting: Displays results sorted by severity

Output Format

Standard Output

🔍 Scanning for dependencies in /home/user/myproject...

Found dependency files: package.json, requirements.txt

Scanning 45 dependencies for CVEs...

📊 Audit Results

Total vulnerabilities found: 8
  🔴 Critical: 1 | 🟠 High: 2 | 🟡 Medium: 4 | 🔵 Low: 1

Showing 3 critical/high vulnerabilities:

📦 express@4.18.0 - 2 vulnerability(ies)

  🔴 CVE-2024-1234
     Score: 9.2 | Buffer overflow in request parsing

  🟠 CVE-2024-5678
     Score: 7.1 | Path traversal in static file handling

─────────────────────────────────────────────────────────────

🐍 django@3.2.10 - 1 vulnerability(ies)

  🟠 CVE-2024-9999
     Score: 7.5 | SQL injection in ORM query handling

─────────────────────────────────────────────────────────────

⚠️  Recommendations:
  1. Update dependencies to patched versions
  2. Review CVE details at https://cve.mitre.org/
  3. Use --no-cache for latest vulnerability data

JSON Output

npx tsx scripts/audit.ts --json

Returns structured data:

{
  "dependencies": [
    {
      "name": "express",
      "version": "4.18.0",
      "source": "npm",
      "file": "/path/to/package.json"
    }
  ],
  "vulnerabilities": [
    {
      "cveId": "CVE-2024-1234",
      "dependency": { "name": "express", "version": "4.18.0", ... },
      "severity": "CRITICAL",
      "score": 9.2,
      "summary": "Buffer overflow in request parsing",
      "affectsVersion": true
    }
  ],
  "summary": {
    "total": 8,
    "critical": 1,
    "high": 2,
    "medium": 4,
    "low": 1
  }
}

Use Cases

Security Audit Before Deployment

Verify your production dependencies are safe:

npx tsx scripts/audit.ts /app/backend --severity critical

Dependency Health Check

Regular checks to catch newly discovered vulnerabilities:

npx tsx scripts/audit.ts . --no-cache

Generate Compliance Reports

Export vulnerability data for security reviews:

npx tsx scripts/audit.ts . --json > vulnerability-report.json

Focus on Critical Issues

Alert on only the most severe vulnerabilities:

npx tsx scripts/audit.ts . --severity critical --json

Multi-Project Assessment

Audit multiple projects in a monorepo:

npx tsx scripts/audit.ts services/auth
npx tsx scripts/audit.ts services/api
npx tsx scripts/audit.ts services/web

Severity Levels

Caching

Results are cached for 24 hours by default. CVE information doesn't change frequently, so caching improves performance.

Use --no-cache when:

• •Running scheduled security audits
• •Recently discovered vulnerabilities may not be cached
• •Doing a fresh security assessment
• •Setting up CI/CD pipelines

Exit Codes

Examples

Audit Node.js project with package.json

cd ~/myapp
npx tsx scripts/audit.ts
# Scans package.json and devDependencies

Audit Python project

cd ~/myproject
npx tsx scripts/audit.ts . --severity high
# Scans requirements.txt, shows only HIGH and CRITICAL

Audit Go project with fresh data

npx tsx scripts/audit.ts /path/to/go/project --no-cache
# Scans go.mod with latest CVE data

Generate JSON report for all vulnerabilities

npx tsx scripts/audit.ts --json > audit-report.json
# Machine-readable format for parsing/integration

CI/CD Integration

# Fail if any critical vulnerabilities found
npx tsx scripts/audit.ts --severity critical
if [ $? -ne 0 ]; then
  echo "Critical vulnerabilities detected!"
  exit 1
fi

Limitations

• •Version matching: Uses simple semantic versioning comparison
• •Direct dependencies only: Scans only direct dependencies listed in source files (not transitive dependencies from lock files)
• •Ruby Gemfile: Only scans gems with explicit version specifications in Gemfile (use Gemfile.lock for complete dependency information)
• •Platform-specific vulnerabilities: Shows all known CVEs regardless of platform
• •Rate limiting: OpenCVE API may limit requests (automatic backoff handled)
• •Accuracy: Depends on CVE database accuracy and product name matching

Performance

• •Typical scan time: 10-60 seconds (depending on dependency count and network)
• •Caching: Significantly reduces repeat scan time
• •Parallel searches: Could be optimized with concurrent API requests

Troubleshooting

"No supported dependency files found"

• •Ensure your project has one of the supported files:
  • •package.json (Node.js)
  • •requirements.txt (Python)
  • •Gemfile (Ruby)
  • •go.mod (Go)
  • •pom.xml (Maven)

Some dependencies not scanned

• •Dependency names must match OpenCVE database naming
• •Some packages use different names in CVE vs package manager
• •Try searching individual dependencies with cve-lookup skill

No vulnerabilities found

• •Your dependencies may be up-to-date
• •Try with --no-cache to check latest database
• •Verify dependency files are valid

Rate limit errors

• •Wait a moment and retry
• •Use cached results from previous queries
• •Reduce severity level to scan fewer CVEs

Related Skills

• •cve-lookup: Search for individual CVEs by ID or product name
• •Combine with version managers to get patches
• •Use results with dependency update tools

References

• •OpenCVE Documentation
• •Official CVE Database
• •CVSS Scoring Guide
• •OWASP Dependency Check - Similar tool for comparison
• •npm Audit Documentation
• •Python PEP 508 - Dependency specification