An npm vulnerability scanner checks the packages in your node_modules tree — direct and transitive — against known vulnerability databases. DepWarden is a free one: paste your lockfile and get a prioritised list of what's actually risky, no account, nothing uploaded but the manifest text.
A typical npm project pulls in hundreds of transitive packages for a handful of direct dependencies — node_modules depth of 5+ levels is normal. Postinstall scripts run arbitrary code on npm install, before you've reviewed anything. Monorepo workspaces mean the same vulnerable package can be pinned to different versions across packages in one repo. A scanner that only reads your direct package.json misses almost the entire real attack surface.
Known CVEs for every direct and transitive package, matched against the full OSV npm advisory feed and enriched with CISA KEV and FIRST EPSS. Typosquats — package names one edit away from a popular package — the class of attack that has no CVE and that npm's own registry doesn't block. Postinstall/preinstall script presence as a risk signal, especially combined with a brand-new version or a single-maintainer package. End-of-life and deprecated packages, and OpenSSF Scorecard health across 18 supply-chain hygiene checks.
package-lock.json (npm v6-v10, lockfileVersion 1-3), yarn.lock (Yarn Classic and Berry), and pnpm-lock.yaml — each parsed for the real resolved transitive graph, not just declared ranges.
Prototype pollution (mutating Object.prototype, common in older lodash/minimist/deep-merge versions), ReDoS (catastrophic-backtracking regular expressions that hang a Node process), and command injection via packages that shell out with unsanitised input.
Usage: paste any of the three lockfile formats above at depwarden.in, or connect a GitHub, GitLab, Bitbucket or Azure DevOps repo branch for a one-off or scheduled scan. Related: better npm audit alternative, software composition analysis, detect typosquats in CI.