code.dependenciesVulnerable dependencies
Parses lockfiles and manifests (npm, bun, pnpm, yarn, pip, poetry, Go, Cargo, Bundler, Composer), checks every pinned version against OSV.dev, and flags wildcard and URL dependencies.
- Engine
- Built-in
- Targets
- Codebase
- Areas
- Supply chain, Security
- Runs
- By default, when the target applies
- Network
- Contacts services beyond the target
Run only this auditor
bunx openaudit . --only code.dependenciesBuilt into openaudit; nothing to install.