Question 1

How do I check my npm dependencies for vulnerabilities?

Accepted Answer

Paste your package.json into Dep Shield. It queries the Google OSV database for every dependency and shows known CVEs with severity, affected versions, and exact npm install commands to fix them.

Question 2

What is the OSV database?

Accepted Answer

OSV (Open Source Vulnerabilities) is Google's free vulnerability database for open source packages. It aggregates data from npm audit, GitHub Security Advisories, and other sources into a single queryable API.

Question 3

Is my package.json sent anywhere?

Accepted Answer

Only package names and version ranges are sent to the public OSV API (osv.dev) to look up known vulnerabilities. No code, no scripts, no private data is transmitted. The network counter on the page shows exactly how many API calls are made.

Question 4

How is this different from npm audit?

Accepted Answer

npm audit requires Node.js installed and runs locally. Dep Shield works in any browser with zero setup. It also shows fix commands and severity in a visual interface without reading lockfiles.

Question 5

Does it support Python, Go, or other ecosystems?

Accepted Answer

Currently Dep Shield supports npm (Node.js) packages. The OSV database also covers PyPI, Go, Maven, and others. Support for additional ecosystems may be added based on demand.