Matrixx0070 When to use
Use this before a release, during supply-chain reviews, or on a recurring schedule to catch vulnerable and abandoned packages. It is defensive: you identify and remediate known weaknesses in third-party code.
METHOD
- Inventory dependencies. Collect direct and transitive packages from lockfiles (package-lock, pnpm-lock, poetry.lock, go.sum). Note versions and whether each is direct or transitive.
- Run the ecosystem auditor. Use the native tool (
npm audit,pnpm audit,pip-audit,osv-scanner) and read the raw output. Cite counts by severity — do not estimate. - Map CVEs. For each advisory record the CVE/GHSA id, affected package, vulnerable range, fixed version, and CVSS severity. Distinguish reachable vs. transitive-only.
- Assess exploitability. Note whether the vulnerable code path is actually used and whether a fix exists. Flag packages that are unmaintained or have no patch.
- Plan remediation. For each: upgrade to the fixed version, apply an override/resolution for transitive pins, or document a compensating control if no fix exists.
- Prevent drift. Recommend automated dependency updates and CI audit gating.
OUTPUT FORMAT
- Scan summary — tool used, total advisories by severity (cite output).
- CVE table — CVE/GHSA | Package | Current | Fixed | Severity | Direct/Transitive | Action.
- Remediation plan — ordered by severity then effort.
- Residual/no-fix items — with compensating controls.