Scan dependencies for CVE vulnerabilities across 11 package managers with fix recommendations
Scan dependencies for CVE vulnerabilities across 11 package managers with fix recommendations
/plugin marketplace add bejranonda/LLM-Autonomous-Agent-Plugin-for-Claude/plugin install bejranonda-autonomous-agent@bejranonda/LLM-Autonomous-Agent-Plugin-for-Claudeanalyze/Comprehensive dependency vulnerability scanning across 11 package managers and ecosystems, with CVE database integration and automated fix recommendations.
/analyze:dependencies [PATH] [OPTIONS]
Examples:
/analyze:dependencies # Scan current project
/analyze:dependencies backend/ # Scan specific directory
/analyze:dependencies --critical-only # Show only critical vulnerabilities
/analyze:dependencies --with-fixes # Include upgrade recommendations
Tools: pip-audit, safety Manifests: requirements.txt, Pipfile, pyproject.toml, poetry.lock
Tools: npm audit, yarn audit, pnpm audit Manifests: package.json, package-lock.json, yarn.lock, pnpm-lock.yaml
Tools: bundle-audit Manifests: Gemfile, Gemfile.lock
Tools: local-php-security-checker Manifests: composer.json, composer.lock
Tools: govulncheck Manifests: go.mod, go.sum
Tools: cargo-audit Manifests: Cargo.toml, Cargo.lock
Tools: dependency-check Manifests: pom.xml, build.gradle, build.gradle.kts
Tools: dotnet list package --vulnerable Manifests: packages.config, *.csproj
Automatically detects package managers:
Detecting Ecosystems...
✅ Python (requirements.txt)
✅ JavaScript (package.json, yarn.lock)
✅ Go (go.mod)
Runs appropriate scanners for each ecosystem:
Scanning Dependencies...
[████████████] Python (pip-audit) - 2.3s
[████████████] npm (npm audit) - 4.1s
[████████████] Go (govulncheck) - 1.8s
Results:
✅ Python: 5 vulnerabilities (2 critical)
✅ npm: 12 vulnerabilities (0 critical)
✅ Go: 0 vulnerabilities
Deduplicates and synthesizes results:
Aggregating Results...
- Total Vulnerabilities: 15 unique
- Duplicates Removed: 2
- Vulnerable Dependencies: 12/187
Risk Score (0-100) =
Critical × 25 +
High × 15 +
Medium × 8 +
Low × 3 +
Info × 1
Example:
- Critical: 2 -> 50 points
- High: 3 -> 45 points
- Medium: 7 -> 56 points
- Low: 3 -> 9 points
---
-----------------------
Total: 160 (capped at 100)
Risk Score: 100/100 (EXTREME)
Risk Levels:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
DEPENDENCY VULNERABILITY SCAN COMPLETE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🎯 Risk Score: 78/100 (HIGH RISK)
📊 Overview
Total Vulnerabilities: 15
Vulnerable Dependencies: 12/187 (6.4%)
Ecosystems: Python, npm, Go
🚨 Vulnerabilities by Severity
🔴 Critical: 2
🟠 High: 3
🟡 Medium: 7
🔵 Low: 3
⚪ Info: 0
📦 By Ecosystem
Python: 5 vulnerabilities
npm: 10 vulnerabilities
Go: 0 vulnerabilities
[WARN]️ Top 3 Vulnerable Packages
1. requests (Python) - 2 vulnerabilities
2. axios (npm) - 3 vulnerabilities
3. lodash (npm) - 2 vulnerabilities
🔴 Critical Vulnerabilities (2)
1. CVE-2023-12345 - requests 2.25.1
SQL injection vulnerability
Fix: Upgrade to 2.31.0+
2. CVE-2023-67890 - axios 0.21.1
Server-side request forgery
Fix: Upgrade to 1.6.0+
📄 Detailed Report: .data/reports/dependency-scan-2025-01-15.md
⏱️ Scan completed in 8.2s
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Saved to .data/reports/dependency-scan-{DATE}.md:
# Dependency Vulnerability Scan Report
**Generated**: 2025-01-15 16:45:23
**Project**: /project
**Risk Score**: 78/100 (HIGH RISK)
---
## Executive Summary
**Total Vulnerabilities**: 15 unique
**Vulnerable Dependencies**: 12 out of 187 total (6.4%)
**Ecosystems Scanned**: Python, npm, Go
**Scan Duration**: 8.2s
**Risk Assessment**: HIGH RISK
- Immediate action required for 2 critical vulnerabilities
- 3 high-severity issues should be addressed soon
- 7 medium-severity issues for next sprint
- 3 low-severity issues can be deferred
---
## Vulnerabilities by Severity
| Severity | Count | Percentage |
|----------|-------|-----------|
| 🔴 Critical | 2 | 13.3% |
| 🟠 High | 3 | 20.0% |
| 🟡 Medium | 7 | 46.7% |
| 🔵 Low | 3 | 20.0% |
| ⚪ Info | 0 | 0.0% |
---
## Vulnerabilities by Ecosystem
### Python (5 vulnerabilities)
- **Critical**: 1
- **High**: 1
- **Medium**: 2
- **Low**: 1
### npm (10 vulnerabilities)
- **Critical**: 1
- **High**: 2
- **Medium**: 5
- **Low**: 2
### Go (0 vulnerabilities)
- No vulnerabilities detected
---
## Top 10 Vulnerable Packages
| Package | Ecosystem | Vulnerabilities | Severity |
|---------|-----------|----------------|----------|
| axios | npm | 3 | 1 Critical, 2 Medium |
| requests | Python | 2 | 1 Critical, 1 High |
| lodash | npm | 2 | 2 Medium |
| urllib3 | Python | 2 | 1 High, 1 Low |
| ws | npm | 1 | 1 High |
| express | npm | 1 | 1 Medium |
| jinja2 | Python | 1 | 1 Medium |
| moment | npm | 1 | 1 Low |
| pyyaml | Python | 1 | 1 Low |
| react-dom | npm | 1 | 1 Medium |
---
## Critical Vulnerabilities (IMMEDIATE ACTION REQUIRED)
### CVE-2023-12345: SQL Injection in requests
**Package**: requests (Python)
**Installed Version**: 2.25.1
**Severity**: 🔴 CRITICAL
**CVSS Score**: 9.8
**Description**:
SQL injection vulnerability in the `requests` library allows remote attackers to execute arbitrary SQL commands via crafted HTTP requests.
**Impact**:
- Database compromise
- Data exfiltration
- Unauthorized access
**CWE**: CWE-89 (SQL Injection)
**Fixed Versions**: 2.31.0, 2.32.0+
**Remediation**:
```bash
# Python (pip)
pip install --upgrade requests>=2.31.0
# Python (poetry)
poetry update requests
References:
Package: axios (npm) Installed Version: 0.21.1 Severity: 🔴 CRITICAL CVSS Score: 9.1
Description: Server-side request forgery (SSRF) vulnerability allows attackers to make the server perform requests to arbitrary destinations.
Impact:
CWE: CWE-918 (SSRF)
Fixed Versions: 1.6.0+
Remediation:
# npm
npm install axios@latest
# yarn
yarn upgrade axios@latest
References:
Package: urllib3 (Python) Installed Version: 1.26.5 Severity: 🟠 HIGH CVSS Score: 7.5
Description: Cross-site scripting vulnerability in URL parsing logic.
Fixed Versions: 1.26.18+, 2.0.7+
Remediation:
pip install --upgrade urllib3>=1.26.18
Package: ws (npm) Installed Version: 7.4.5 Severity: 🟠 HIGH CVSS Score: 7.5
Description: Denial of service vulnerability via regular expression DoS in WebSocket implementation.
Fixed Versions: 7.5.10+, 8.17.1+
Remediation:
npm install ws@latest
Package: express (npm) Installed Version: 4.17.1 Severity: 🟠 HIGH CVSS Score: 7.3
Description: Path traversal vulnerability allows access to files outside webroot.
Fixed Versions: 4.19.2+
Remediation:
npm install express@latest
[... 7 medium-severity vulnerabilities with similar detail ...]
[... 3 low-severity vulnerabilities with similar detail ...]
# Upgrade all vulnerable packages
pip install --upgrade \
requests>=2.31.0 \
urllib3>=1.26.18 \
jinja2>=3.1.3 \
pyyaml>=6.0.1
# Or use requirements file
pip install -r requirements-secure.txt
requirements-secure.txt (generated):
requests>=2.31.0
urllib3>=1.26.18
jinja2>=3.1.3
pyyaml>=6.0.1
# Upgrade all vulnerable packages
npm install \
axios@latest \
lodash@latest \
ws@latest \
express@latest \
moment@latest \
react-dom@latest
# Or auto-fix with npm audit
npm audit fix --force
These upgrades are backward-compatible (semver minor/patch):
# Python
pip install --upgrade requests urllib3 pyyaml
# npm
npm audit fix
These upgrades may have breaking changes (semver major):
axios: 0.21.1 -> 1.6.0 (major version bump)
express: 4.17.1 -> 4.19.2 (minor bump, but middleware changes)
By Ecosystem:
Security Status:
Freshness:
Detected Licenses:
Component Scores:
- Critical Vulnerabilities (2 × 25): 50 points
- High Vulnerabilities (3 × 15): 45 points
- Medium Vulnerabilities (7 × 8): 56 points
- Low Vulnerabilities (3 × 3): 9 points
--------------------------------------------
Total: 160 points (capped at 100)
Final Risk Score: 100/100 -> Normalized: 78/100
Risk Level: 🔴 HIGH RISK
Mitigation:
Estimated Time to Secure:
requests to 2.31.0+ (30 min)axios to 1.6.0+ (45 min + testing)Total: 2-3 hours
urllib3, ws, express (2 hours)Total: 9 hours
Total: 8 hours
Recommendations:
GitHub Actions Example:
name: Dependency Scan
on:
schedule:
- cron: '0 0 * * 0' # Weekly
pull_request:
branches: [main]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Scan Dependencies
run: /analyze:dependencies --format=sarif --output=results.sarif
- name: Upload Results
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: results.sarif
End of Report
## Advanced Features
### Critical-Only Mode
```bash
/analyze:dependencies --critical-only
Shows only critical vulnerabilities for rapid triage.
/analyze:dependencies --with-fixes
Includes detailed upgrade commands and compatibility notes.
/analyze:dependencies --format=json --output=scan-results.json
Machine-readable format for automation.
/analyze:dependencies --format=sarif
Standard format for security tools integration.
The dependency scanner integrates with pattern learning:
# After each scan
learning_engine.store_pattern({
"task_type": "dependency_scan",
"context": {
"ecosystems": ["python", "npm"],
"total_dependencies": 187,
"vulnerable_count": 12
},
"outcome": {
"risk_score": 78,
"critical_count": 2,
"high_count": 3
},
"trends": {
"risk_score_delta": -5, # Improved from last scan
"new_vulnerabilities": 3,
"fixed_vulnerabilities": 8
}
})
| Ecosystem | Dependencies | Scan Time |
|---|---|---|
| Python | <50 | 5-15s |
| Python | 50-200 | 15-45s |
| npm | <100 | 10-30s |
| npm | 100-500 | 30-90s |
| Go | <50 | 5-10s |
| Rust | <50 | 10-20s |
| Multi | Mixed | 30-120s |
This command provides comprehensive dependency vulnerability scanning with minimal setup and maximum actionable insight.