Every project you've shipped, checked for vulnerable packages.
Sign in with GitHub, pick your repos, and NPMscan shows which ones depend on vulnerable or outdated npm or Composer packages, with the worst first. Built for people with more projects than time.
No access tokens to create, no credit card. Or scan a public repo without signing up.
One report for every lockfile in the repo
NPMscan reads the lockfile each project already commits, so it checks the versions you actually install. A Laravel API and the Vite front end beside it show up in the same report, with the right install command for each.
Dependabot tells you about one repo at a time. You have twenty.
Side projects, client sites, things you shipped last year and forgot about. NPMscan puts all of them on one page.
Every repo in one view
Personal projects, client work and organisation repos side by side, worst first.
Known vulnerabilities
The exact versions in your lockfile, including packages your dependencies pull in, checked against the OSV.dev database with the version that fixes each one.
Outdated packages
See which packages are behind and by how much, so you can update before it becomes urgent.
Old runtimes and images
A warning when a project declares a PHP or Node version, or uses a Docker base image, that has stopped getting security fixes, or soon will.
A score to sort by
A 0 to 100 health score per project tells you where to spend your next hour.
One email a week tells you which project needs you
Every week NPMscan rescans your projects and sends a short summary. New advisories come first, with the package, the project it's in and a link to the details. When nothing changed, the email says so in one line.
No dashboard to remember to open, and it's included on every plan, Free too.
2 new vulnerabilities in your projects this week
This week's scan found 2 new vulnerabilities that weren't there last week.
- CRITICAL
next@14.1.0in client-shop - HIGH
axios@1.6.0in client-shop
- client-shop4 vulnerable packages
- marketing-siteNo known vulnerable packages
- booking-appNo known vulnerable packages
Set up in a minute
- 1
Sign in with GitHub
Approve read access once. Personal and organisation repos both work.
- 2
Pick your projects
Your most recently updated repos are selected for you. Change them if you like.
- 3
Watch the first scan
Results appear while you wait. After that we rescan every week and email you what changed.
Priced per project, not per developer
Start free. Upgrade when you have more to watch.
Questions
What access does NPMscan need?
Access to the repositories you choose, granted when you sign in with GitHub. GitHub labels this "full control of private repositories" because it has no narrower option for private repos. NPMscan only reads dependency files such as package.json, lockfiles, composer.json and Dockerfiles. It never writes to your repos, never stores your source code, and you can revoke access from GitHub at any time.
Which projects can it scan?
npm, Yarn and pnpm projects today, including monorepos. NPMscan reads your lockfile for exact versions; without one it checks the lowest version each range allows. Composer projects too: NPMscan reads composer.lock and checks each package for known vulnerabilities. It also warns when a project declares a PHP or Node version, or a Docker base image such as php:8.1 or postgres:12, that no longer gets security fixes.
Do I still need Dependabot?
Keep it for update pull requests. NPMscan gives you the overview across all your repos that Dependabot does not.
How often are projects scanned?
Whenever you click Scan, and automatically once a week on every plan, with an email summary of anything new.
Can I cancel anytime?
Yes. Cancel from Settings and keep your plan until the end of the billing period.