Dependency Security Check

Scan dependencies for known vulnerabilities.

Usage: /vibe-check:deps

Instructions

Step 1: Run npm audit

npm audit --json 2>/dev/null

If pnpm:

pnpm audit --json 2>/dev/null

If yarn:

yarn audit --json 2>/dev/null

Step 2: Parse Results

npm audit JSON structure:

{
  "vulnerabilities": {
    "package-name": {
      "name": "package-name",
      "severity": "high",
      "via": [...],
      "effects": [...],
      "range": ">=1.0.0 <1.2.3",
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "critical": 0,
      "high": 2,
      "moderate": 5,
      "low": 1
    }
  }
}

Step 3: Categorize Findings

npm Severity	vibe-check Severity
critical	CRITICAL
high	HIGH
moderate	MEDIUM
low	LOW

Step 4: Check for Fixable Issues

For each vulnerability, check fixAvailable:

• If true: Include upgrade command
• If false: Note as "requires manual intervention"

Step 5: Common Risky Packages

Flag regardless of vulnerabilities:

• Outdated React (<18) - Missing security fixes
• Old Next.js (<13) - Known vulnerabilities
• Unmaintained packages - No security updates

Check last publish date:

npm view package-name time.modified

Step 6: Lock File Analysis

Check for lock file presence:

• package-lock.json (npm)
• pnpm-lock.yaml (pnpm)
• yarn.lock (yarn)

Missing lock file = MEDIUM severity (inconsistent installs).

Output Format

[HIGH] Vulnerable Dependency: lodash
Package: lodash@4.17.20
Severity: High
Vulnerability: Prototype Pollution (CVE-2021-23337)
Affected: lodash <4.17.21

Fix:
npm update lodash
# or
npm install lodash@latest

[CRITICAL] Critical Vulnerability: next
Package: next@12.3.0
Severity: Critical
Vulnerability: Server-Side Request Forgery
Affected: next <13.4.6

Fix:
npm install next@latest

Note: Major version upgrade - review breaking changes:
https://nextjs.org/docs/upgrading

Summary Output

Dependency Audit Summary
========================
Critical: 1
High: 2
Moderate: 5
Low: 3

Fixable: 8/11

Run to fix all:
npm audit fix

Run for breaking changes:
npm audit fix --force

Recommendations

1. Enable Dependabot - Auto PRs for security updates
2. Use npm-check-updates - npx ncu -u for bulk updates
3. Lock versions - Avoid ^ for critical packages
4. Regular audits - Run npm audit before each deploy