dsh-dependency-audit

Third-party dependencies can carry silent CVEs for months before anyone notices, yet most dev workflows lack a lightweight, in-the-moment channel to ask the simple question: how much risk is sitting in my node_modules right now? dsh-dependency-audit pulls that check into the conversation itself—no extra services to deploy, no CI pipeline to configure. A single invocation returns a full security picture of every resolvable installed dependency in seconds.

Two audit tools power the plugin. audit_vulnerabilities batches lookups against OSV.dev, the open-source vulnerability database that aggregates feeds from GitHub Advisory and other sources, and returns the CVE ID, severity level, a brief summary, and the fixed version for every affected package—free, with no API key required. audit_outdated compares each installed version against the latest on the npm registry, flags outdated packages, and labels the upgrade magnitude (major / minor / patch) so you can triage high-impact cross-version changes first. Under the hood it is a pure Node.js implementation whose only runtime requirement is network reachability to osv.dev and the npm registry.

It is aimed at solo developers and small teams who want a quick security pulse without standing up a dedicated security toolchain, especially in environments where no one is solely responsible for dependency hygiene. Paired with dsh-license-guard (license compliance) and dsh-secret-scan (secret detection), the three plugins form a compact security trio that covers the most common attack surfaces: unpatched vulnerabilities, licensing drift, and accidental credential leaks.