Every project you've shipped, checked for vulnerable packages.
Sign in with GitHub, pick your repos, and NPMscan shows which ones depend on vulnerable or outdated npm packages, with the worst first. Built for people with more projects than time.
No access tokens to create, no credit card.
Composer projects and PHP version checks
The October 2026 PHP2Shell bugs were in PHP itself, not in a package. We're adding composer.lock scanning and warnings when a project declares a PHP or Node version that needs a security update.
Dependabot tells you about one repo at a time. You have twenty.
Side projects, client sites, things you shipped last year and forgot about. NPMscan puts all of them on one page.
Every repo in one view
Personal projects, client work and organisation repos side by side, worst first.
Known vulnerabilities
The exact versions in your lockfile, including packages your dependencies pull in, checked against the OSV.dev database with the version that fixes each one.
Outdated packages
See which packages are behind and by how much, so you can update before it becomes urgent.
A score to sort by
A 0 to 100 health score per project tells you where to spend your next hour.
Set up in a minute
- 1
Sign in with GitHub
Approve read access once. Personal and organisation repos both work.
- 2
Pick your projects
Your most recently updated repos are selected for you. Change them if you like.
- 3
Watch the first scan
Results appear while you wait, then every Monday on paid plans.
Priced per project, not per developer
Start free. Upgrade when you have more to watch.
Questions
What access does NPMscan need?
Read access to the repositories you choose, granted when you sign in with GitHub. It reads package files, never writes to your repos, and you can revoke access from GitHub at any time.
Which projects can it scan?
npm, Yarn and pnpm projects today, including monorepos. NPMscan reads your lockfile for exact versions; without one it checks the lowest version each range allows. Composer and PHP support is in development.
Do I still need Dependabot?
Keep it for update pull requests. NPMscan gives you the overview across all your repos that Dependabot does not.
How often are projects scanned?
Whenever you click Scan, and automatically every Monday on paid plans.
Can I cancel anytime?
Yes. Cancel from Settings and keep your plan until the end of the billing period.