What tools do you use to monitor for NPM and other dependency vulnerabilities?

Posted by tiagom87 on Thursday September 11, 2025 @03:04AM
from the self-post dept.

Following the npm hack, I think this is an attack vector that will get more popular in the short term. What tools beside npm audit and dependabot, do you use to monitor for dependency security vulnerabilities?

( 2 comments | on HN )

Re:What tools do you use to monitor for NPM and other depend... by patrick4urcloud on Thursday September 11, 2025 @03:43AM (#45208932)

Hello, We add a check in npm packages in kexa.io .

see https://medium.com/@contact_52772/malicious-npm-packages-aut... .

For futur we can add a call to an open source api to list the ban packages. Thank you, Patrick

[ Parent | on HN ]

Re:What tools do you use to monitor for NPM and other depend... by palmfacehn on Thursday September 11, 2025 @03:56AM (#45209026)

My strategy has been to limit my exposure to the larger NPM/Node.js ecosystem. I'll use it only in limited cases where a front-end dependency is required.

[ Parent | on HN ]