The hook
Dependency vulnerabilities are the most consistently-exploited class of bugs because they require zero target-specific work. The attacker doesn't need to find a unique flaw in your code — they find a target running a vulnerable version of a popular library and run the published exploit. Log4Shell, Spring4Shell, the Polyfill.io supply-chain attack, lodash prototype pollution, the ws library DoS, the colors.js sabotage — each one was 'every project running affected version X is vulnerable until they upgrade.' Modern apps depend on hundreds or thousands of transitive packages; the surface is enormous and it grows faster than human review can keep pace. Automated scanning is the only realistic answer.
အလုပ်လုပ်ပုံ
FixVibe parses your `package.json`, `pnpm-lock.yaml`, `package-lock.json`, `requirements.txt`, `Pipfile.lock`, `Gemfile.lock`, `composer.lock`, `go.sum`, or `Cargo.lock` from your GitHub repo, resolves the full dependency tree (including transitive deps), then queries OSV.dev for known CVEs against each `package@version` pair. OSV.dev is the canonical aggregator — it pulls from npm advisories, PyPI advisories, GitHub Security Advisories, and many language-specific feeds, normalized to a single API. Findings include the CVE ID, severity, affected version range, and the fixed version.
The variants
Direct dependencies with known CVEs
Packages you explicitly list in your manifest. Easy to upgrade — bump the version, run tests, ship.
Transitive dependencies
Pulled in by other packages, sometimes deeply nested. Harder to upgrade because you don't control the parent's version pin. Override mechanisms (`overrides` in npm, `resolutions` in Yarn) help.
Abandoned / unmaintained packages
Vulnerable package whose maintainer is gone. No patch coming. Migration to an alternative is the only fix.
Supply-chain attacks
Compromised package version (Polyfill.io, event-stream, ua-parser-js incidents). Different vulnerability shape — newer is worse than older for these — but the same scanning pattern catches it.
The blast radius
Tracks the CVE. Critical CVEs in popular packages get mass-exploited within hours of publication. Log4Shell scanning hit every internet-facing Java service in under 12 hours. Spring4Shell within 24. The polyfill.io supply-chain attack was active across millions of sites before disclosure. RCE-class CVEs are the headline cases; even non-RCE vulnerabilities (DoS, prototype pollution, ReDoS) can be operationally significant. Beyond the immediate exploit, vulnerable dependencies are often blocking factors for SOC 2 / ISO 27001 audits and enterprise procurement.
// what fixvibe checks
What FixVibe checks
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Ironclad defenses
Keep dependencies current via automation. Dependabot (GitHub-native) and Renovate (more configurable) both open PRs continuously for security advisories. Configure auto-merge for minor and patch updates that pass CI; require manual review only for major versions. Have a stated policy for how fast you patch (24h for critical, 7d for high is realistic for most teams) and a tested process for the rare 'we need to ship a patch in 2 hours' Log4Shell-class event. Subscribe to the security advisory feed for the specific frameworks you use — don't wait for the scanner to surface a CVE that hit security-twitter days ago. Reduce attack surface: audit your dependency tree periodically and remove packages you don't actually use; use bundler features that warn on unused deps. For libraries you can't easily upgrade (legacy enterprise frameworks, vendor-locked tools), evaluate compensating controls (WAF rules, network segmentation) and document the risk acceptance. Finally, maintain a Software Bill of Materials (SBOM) for your production builds — when the next big CVE drops, you want to know in minutes whether you're affected, not hours.