What tools do you use to monitor for NPM and other dependency vulnerabilities?

2 tiagom87 2 9/11/2025, 7:04:55 AM

Following the npm hack, I think this is an attack vector that will get more popular in the short term. What tools beside npm audit and dependabot, do you use to monitor for dependency security vulnerabilities?

Comments (2)

patrick4urcloud · 3h ago

Hello, We add a check in npm packages in kexa.io .

see https://medium.com/@contact_52772/malicious-npm-packages-aut... .

For futur we can add a call to an open source api to list the ban packages. Thank you, Patrick

palmfacehn · 3h ago

My strategy has been to limit my exposure to the larger NPM/Node.js ecosystem. I'll use it only in limited cases where a front-end dependency is required.

Google Ends Support for Lynx Browser

Google Doesn't Rank My Site for My Own Brand Name

Linter for Your Docs

Old timers, what did you read to study Unix or languages by the book?

Ask HN: Good resources for DIY-ish animatronic kits for Halloween?

Ask HN: Would you use a CAPTCHA that blocks browser agents?

Ask HN: Were programmers more surprised than general public by ChatGPT in 2022?

Which would you subscribe: HBR / The Economist / Farnam Street?

Ask HN: How are you preparing for upcoming short-lived SSL renewals?

Ask HN: Who wants to be hired? (September 2025)

Ask HN: Looking for headless CMS recommendation

Plex Update: Notice of a potential security incident

Ask HN: Who is hiring? (September 2025)

Ask HN: What are the best AI video generator online? Both free and paid

YC Demo Day: I mapped out every YC company on an interactive world map

My Workflow Is 70% AI, 20% Copy-Paste, 10% Panic. What's Yours?

Ask HN: Does anyone else pronounce CLI as "clee"?

Ask HN: How high is the bar for AGI? what problems are "AGI-complete"?

AI code is creating more Ops incidents – who should own fixing them?

Google Meet Outage

Apple adds matmul acceleration to A19 Pro GPU

SharedVolume – a Kubernetes operator to sync Git/S3/HTTP/SSH volumes across pods

What tools do you use to monitor for NPM and other dependency vulnerabilities?

Comments (2)