Dependency Risk Explainer

How it works

Paste a package.json excerpt - dependencies and optionally devDependencies - and get high-level risk themes instead of a wall of CVE noise. Typical themes include outdated major frameworks, auth or crypto libraries that need careful upgrades, bloated front-end surface area, native or binary addons, and general supply-chain hygiene (lockfiles, unexpected maintainers, unused packages). Strip any secrets before pasting; only package names and versions are needed. This tool does not query OSV, NVD, GitHub Advisories, or any vulnerability database, and it will not invent CVE identifiers. It explains patterns so you know where to look next with npm audit, pnpm audit, Dependabot, Snyk, or a dedicated SCA product. Treat the output as a conversation starter for engineering review, not a pass/fail compliance gate. Absence of a theme does not mean you have zero vulns. For the live product surface - headers, TLS, cookies, exposed paths - run an AtRisk URL scan. Starter unlocks severity depth and fix prompts when you are ready to remediate what is reachable from the internet.

Theme explainer only - not an OSV/CVE vulnerability database scan. Do not treat absence of themes as “no vulns.”