Dependencies
Vulnerable packages across forty ecosystems, direct and transitive, with the safe version to move to.
Software composition analysis: which packages your project uses, and which of them have known vulnerabilities.
Where the finding lands
On the line that declares the dependency, in the file you would edit to change it. Not at the top of the file, and not on a lockfile entry you never wrote.
That sounds obvious and is the hardest part of the feature. Package parsers produce a list of names and versions with no position information at all, so the extension re-reads each manifest with a position-aware parser: byte offsets for JSON, node positions for YAML, the module syntax tree for go.mod, line matching for requirements.txt and Gemfile.
Where a format genuinely cannot give an exact position, the finding is anchored as closely as possible and marked as approximate rather than silently pretending to precision.
Transitive dependencies have no line to point at, because you never declared them. Those anchor in the lockfile, and carry the chain that introduced them:
introduced via express@4.17.1 → qs@6.5.2
Ecosystems
npm, PyPI, Go, Maven and Gradle, Cargo, RubyGems, NuGet, Composer, Swift, Hex, Pub, Conda, CocoaPods, Conan, vcpkg, CRAN, Hackage, opam, Nix, Zig, Julia, Crystal, Deno, Erlang, and more, along with Docker images, Helm charts, CI pipeline definitions and shell scripts that install packages.
Both declared manifests and installed trees are read, so a dependency present in node_modules but missing from package.json is still found.
What a finding tells you
- Every advisory affecting the version in use, with CVSS, EPSS and SSVC
- Whether it is in CISA’s or the EU’s Known Exploited Vulnerabilities catalogue
- Whether public exploit code exists, and how mature it is
- The safe version to move to, and whether that is a major bump
- Whether the package is end-of-life or has been flagged as malicious
- Where it came from, if you did not add it yourself
Tuning
| Setting | Default | Effect |
|---|---|---|
vulnetix.sca.diagnosticGranularity | package | One finding per package, or one per advisory |
vulnetix.sca.annotateLockfiles | transitiveOnly | Whether lockfiles get findings of their own |
vulnetix.diagnostics.minimumSeverity | low | Hide findings below a threshold |
vulnetix.qualityGate.exploits | unset | Show only findings with exploit activity |
Network use
Matching a package to advisories requires the vulnerability database; there is no local copy. Only package coordinates are sent, never code. Results are cached, and a manifest save whose dependency set did not change produces no request at all. See privacy.