For indie developers, freelancers and agencies

Every project you've shipped, checked for vulnerable packages.

Sign in with GitHub, pick your repos, and NPMscan shows which ones depend on vulnerable or outdated npm or Composer packages, with the worst first. Built for people with more projects than time.

Sign in with GitHub, free for 3 projectsSee how it works

No access tokens to create, no credit card.

Works withnpmYarnpnpmComposer
JavaScript and PHP

One report for every lockfile in the repo

NPMscan reads the lockfile each project already commits, so it checks the versions you actually install. A Laravel API and the Vite front end beside it show up in the same report, with the right install command for each.

npmpackage-lock.jsonLockfile versions 1 to 3, workspaces included.
Yarnyarn.lockYarn 1 and Yarn Berry lockfiles.
pnpmpnpm-lock.yamlpnpm 7, 8 and 9 lockfiles, monorepos included.
Composercomposer.lockLaravel, Symfony and any project with a composer.json.
PHP and Node versionscomposer.json · .nvmrc · enginesFlags a declared version that no longer gets security fixes.
How the PHP and Composer checks work

Dependabot tells you about one repo at a time. You have twenty.

Side projects, client sites, things you shipped last year and forgot about. NPMscan puts all of them on one page.

Every repo in one view

Personal projects, client work and organisation repos side by side, worst first.

Known vulnerabilities

The exact versions in your lockfile, including packages your dependencies pull in, checked against the OSV.dev database with the version that fixes each one.

Outdated packages

See which packages are behind and by how much, so you can update before it becomes urgent.

Old PHP and Node versions

A warning when a project declares a PHP or Node version that has stopped getting security fixes, or soon will.

A score to sort by

A 0 to 100 health score per project tells you where to spend your next hour.

Set up in a minute

  1. 1

    Sign in with GitHub

    Approve read access once. Personal and organisation repos both work.

  2. 2

    Pick your projects

    Your most recently updated repos are selected for you. Change them if you like.

  3. 3

    Watch the first scan

    Results appear while you wait, then every Monday on paid plans.

Priced per project, not per developer

Start free. Upgrade when you have more to watch.

Free$0
  • Up to 3 projects
  • Scan whenever you like
Start free
Indie$5 /month
  • Up to 15 projects
  • Automatic weekly scans
Choose Indie
Agency · Recommended$29 /month
  • Up to 75 projects
  • Automatic weekly scans
Choose Agency
Studio$79 /month
  • Unlimited projects
  • Automatic weekly scans
Choose Studio

Questions

What access does NPMscan need?

Read access to the repositories you choose, granted when you sign in with GitHub. It reads package files, never writes to your repos, and you can revoke access from GitHub at any time.

Which projects can it scan?

npm, Yarn and pnpm projects today, including monorepos. NPMscan reads your lockfile for exact versions; without one it checks the lowest version each range allows. Composer projects too: NPMscan reads composer.lock and checks each package for known vulnerabilities. It also warns when a project declares a PHP or Node version that no longer gets security fixes.

Do I still need Dependabot?

Keep it for update pull requests. NPMscan gives you the overview across all your repos that Dependabot does not.

How often are projects scanned?

Whenever you click Scan, and automatically every Monday on paid plans.

Can I cancel anytime?

Yes. Cancel from Settings and keep your plan until the end of the billing period.