Real-time, shift-left dependency vulnerability scanning for package.json, powered by OSV.dev.
Detects vulnerabilities in both direct dependencies and every transitive package installed under them, and attributes the risk back to the top-level entry in package.json that owns it.
Features
- 🛡️ Inline diagnostics on the exact version string of each vulnerable dependency
- 🔗 Deep scanning of the entire installed tree via
npm ls --all --json - 🧭 Transitive vulnerabilities surfaced on the direct dep that pulls them in, with the full dependency path
- 💡 Quick-fix upgrade action for direct-dep vulnerabilities
- 🖱️ Rich hover cards with CVE ids, severity, aliases and OSV.dev links
- ⚡ LRU-cached OSV batch queries and lockfile-keyed dep-tree cache
Requirements
- Node.js and
npmavailable onPATH(used to gather the installed dep tree) - Project must have run
npm installat least once sonpm lscan resolve versions
Settings
| Setting | Default | Description |
|---|---|---|
fmd.debounceMs |
750 |
Debounce interval before a scan runs after edits |
fmd.cacheSize |
1000 |
LRU cache size for package/version lookups |
fmd.scanTransitive |
true |
Scan the full npm ls tree, not just direct deps |
fmd.npmLsTimeoutMs |
20000 |
Timeout for the npm ls invocation |
Commands
- Flaw Mining Disorder: Show Logs — reveal the extension output channel
- Flaw Mining Disorder: Rescan Active package.json — force a fresh scan and drop the cached dep tree
License
MIT
