What tools do you use to monitor for NPM and other dependency vulnerabilities?

2 tiagom87 2 9/11/2025, 7:04:55 AM

Following the npm hack, I think this is an attack vector that will get more popular in the short term. What tools beside npm audit and dependabot, do you use to monitor for dependency security vulnerabilities?

Comments (2)

patrick4urcloud · 3h ago

Hello, We add a check in npm packages in kexa.io .

see https://medium.com/@contact_52772/malicious-npm-packages-aut... .

For futur we can add a call to an open source api to list the ban packages. Thank you, Patrick

palmfacehn · 3h ago

My strategy has been to limit my exposure to the larger NPM/Node.js ecosystem. I'll use it only in limited cases where a front-end dependency is required.

We should have the ability to run any code we want on hardware we own (hugotunius.se)

Cognitive load is what matters (github.com)

NPM debug and chalk packages compromised (aikido.dev)

I ditched Docker for Podman (codesmash.dev)

30 minutes with a stranger (pudding.cool)

996 (lucumr.pocoo.org)

Next.js is infuriating (blog.meca.sh)

I didn't bring my son to a museum to look at screens (sethpurcell.com)

The MacBook has a sensor that knows the exact angle of the screen hinge (twitter.com)

Show HN: I recreated Windows XP as my portfolio (mitchivin.com)

Anthropic agrees to pay $1.5B to settle lawsuit with book authors (nytimes.com)

Signal Secure Backups (signal.org)

Show HN: Term.everything – Run any GUI app in the terminal (github.com)

Using Claude Code to modernize a 25-year-old kernel driver (dmitrybrant.com)

Charlie Kirk killed at event in Utah (nbcnews.com)

iPhone Air (apple.com)

Google can keep its Chrome browser but will be barred from exclusive contracts (cnbc.com)

I replaced Animal Crossing's dialogue with a live LLM by hacking GameCube memory (joshfonseca.com)

Pontevedra, Spain declares its entire urban area a "reduced traffic zone" (greeneuropeanjournal.eu)

We all dodged a bullet (xeiaso.net)

Stripe Launches L1 Blockchain: Tempo (tempo.xyz)

Mistral raises 1.7B€, partners with ASML (mistral.ai)

“This telegram must be closely paraphrased before being communicated to anyone” (history.stackexchange.com)

Chat Control Must Be Stopped (privacyguides.org)

New Mexico is first state in US to offer universal child care (governor.state.nm.us)

Almost anything you give sustained attention to will begin to loop on itself (henrikkarlsson.xyz)

Where's the shovelware? Why AI coding claims don't add up (mikelovesrobots.substack.com)

Google AI Overview made up an elaborate story about me (bsky.app)

Claude Code: Now in Beta in Zed (zed.dev)

Eternal Struggle (yoavg.github.io)

iPhone dumbphone (stopa.io)

ICE is using fake cell towers to spy on people's phones (forbes.com)

Claude now has access to a server-side container environment (anthropic.com)

I'm absolutely right (absolutelyright.lol)

LLM Visualization (bbycroft.net)

Notes on Managing ADHD (borretti.me)

Serverless Horrors (serverlesshorrors.com)

MIT Study Finds AI Use Reprograms the Brain, Leading to Cognitive Decline (publichealthpolicyjournal.com)

The maths you need to start understanding LLMs (gilesthomas.com)

No adblocker detected (maurycyz.com)

AI surveillance should be banned while there is still time (gabrielweinberg.com)

Wikipedia survives while the rest of the internet breaks (theverge.com)

E-paper display reaches the realm of LCD screens (spectrum.ieee.org)

Fil's Unbelievable Garbage Collector (fil-c.org)

Anthropic raises $13B Series F (anthropic.com)

We already live in social credit, we just don't call it that (thenexus.media)

Google: 'Your $1000 phone needs our permission to install apps now' [video] (youtube.com)

14 Killed in anti-government protests in Nepal (tribuneindia.com)

Immich – High performance self-hosted photo and video management (github.com)

Bear is now source-available (herman.bearblog.dev)

What tools do you use to monitor for NPM and other dependency vulnerabilities?

Comments (2)