# Depcheck

> Checks projects and packages for CVEs using Socket.dev CLI and native audit commands. Use when installing or auditing dependencies for vulnerabilities, evaluating a package before install, or scanning a project's dependency tree (npm, bun, Python/uv, PyPI).

- Skill: `usrrname/depcheck` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add usrrname/depcheck`
- Raw SKILL.md: https://api.skillmd.com/api/skills/usrrname/depcheck/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: usrrname (https://skillmd.com/u/usrrname)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/usrrname/depcheck

---


# Dependency Analysis with Socket

Use the [Socket CLI](https://docs.socket.dev/docs/socket-cli) (`@socketsecurity/cli`) to check for CVEs in direct and transitive dependencies. Also covers native audit commands for npm, yarn, pnpm, bun, and Python/uv.

## Prerequisites

```bash
npm install -g @socketsecurity/cli
socket login   # or: export SOCKET_SECURITY_API_TOKEN=<token>
```

## Check a single package for CVEs

```bash
socket package score npm <package> --markdown     # deep (includes transitives)
socket package shallow npm <package>              # shallow (package only)
socket package shallow npm react lodash eslint    # multiple packages
socket package score pypi <package> --markdown    # Python/PyPI deep score
socket package shallow pypi <package>             # Python/PyPI shallow score
```

## Check a project for CVEs

```bash
socket scan create <dir> --report                # full scan
socket ci                                        # CI gate (non-zero on failure)
socket scan create . --json | jq '.alerts[] | select(.severity == "critical")'
```

## Native audit commands (no Socket required)

No lockfile? Use `npx audit-ci --high`.

### npm

```bash
npm audit --audit-level=high
npm audit --json | jq '.vulnerabilities | to_entries[] | select(.value.severity == "high" or .value.severity == "critical")'
```

### yarn v1

```bash
yarn audit --level high
```

### yarn v4+ (berry)

```bash
yarn npm audit --all --severity high
```

### pnpm

```bash
pnpm audit --audit-level=high
pnpm audit --audit-level=medium     # include medium-severity CVEs
pnpm audit --fix                    # write overrides to pnpm-workspace.yaml
```

### bun

```bash
bun audit --audit-level high
```

### Python / uv

```bash
uv audit                      # uv-native audit of pyproject.toml + uv.lock (OSV); non-zero on findings
uvx pip-audit                 # pip-audit on current env (works without uv)
uvx pip-audit -r requirements.txt
uv audit --format json        # machine-readable output
```

- `uv audit` is in preview and requires uv >= 0.10.12: `uv self update`.
- Enable malware checks on every `uv add` / `uv sync` with `UV_MALWARE_CHECK=1` — aborts sync before known-malicious code runs.

## Secure install wrapper

```bash
socket npm install           # drop-in npm replacement with scanning
socket npx <package>         # scans before executing
socket wrapper --on/--off    # toggle globally
```

## Pin dependency versions

Before pinning, check for a lockfile (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lock`, `uv.lock`, `poetry.lock`, `Pipfile.lock`). If one exists, update it with the package manager's install command rather than hand-editing pins.

All dependencies in `package.json` MUST be pinned to exact versions. No semver ranges (`^`, `~`, `*`, `>`, `<`, `>=`, `<=`). Applies to `dependencies`, `devDependencies`, `peerDependencies`, and `optionalDependencies`.

See [references/pinning.md](references/pinning.md) for rationale, examples, and update workflow.

## Pin GitHub Actions to commit SHAs

All GitHub Actions MUST be referenced by their full commit SHA, NOT by version tags or branch names. Applies to every `uses:` directive in workflows.

Use `git ls-remote https://github.com/<owner>/<repo> refs/tags/<version>` to find the SHA. Keep the version tag as a trailing comment for readability.

See [references/github-actions.md](references/github-actions.md) for rationale and examples.

## Set minimum release cooldown period

Set `minimumReleaseAge` of 7 days in workspace or lockfiles.

## References

- [Socket CLI docs](https://docs.socket.dev/docs/socket-cli) — full command reference, score interpretation, alert severity levels
- [Socket package scores](https://docs.socket.dev/docs/package-scores) — scoring dimensions and methodology
- [Alert types](https://docs.socket.dev/docs/alert-types) — CVE, supply chain, quality, maintenance, license alerts