Skip to content
Noroxi

Online npm audit: package-lock and SBOM scanner

Dependency scan (SBOM)

Upload your package-lock.json, yarn.lock, pnpm-lock.yaml, composer.lock or a CycloneDX/SPDX file. It shows which dependencies have known vulnerabilities, whether they are exploited in the wild (KEV) and which version to upgrade to.

or paste

The file is parsed in your browser and never sent to the server. Only the list of package names and versions is sent; that list and the match result are kept in our usage log.

What is an SBOM, and how is it different from a lockfile?

An SBOM (software bill of materials) is a file that lists every package inside an application with its version; the common formats are CycloneDX and SPDX. A lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, composer.lock) holds the same information in your package manager's own format. Noroxi Dependency scan reads both and compares each package version with the affected version ranges in OSV and GitHub Advisory Database records.

How to read the result

Vulnerable
Components whose version falls inside the affected range of at least one record. Each row lists the records affecting that component.
KEV
Vulnerabilities CISA has confirmed as exploited in the wild. Fix these first.
Upgrade
The highest fix version reported by the records affecting the component. “No fix” means at least one of those records reports no fix version.
Skipped
Dev dependencies are not matched because they never reach production. Entries without an exact version (ranges, git URLs, local paths) cannot be compared.

Frequently asked questions

Is my file uploaded to your server?
No. The file is parsed in your browser; only the list of package names and versions is sent. That list and the match result are stored in our usage log.
How is this different from npm audit?
The vulnerability data comes from the same place: the GitHub Advisory Database that npm audit uses. The difference is in input and output: this page also reads Composer lockfiles and CycloneDX/SPDX lists, needs no access to your repository and reports KEV status with the result.
If nothing is found, are my dependencies clean?
That is not a guarantee. Only packages with a record in OSV or the GitHub Advisory Database are compared; a vulnerability with no record, or one not yet published, will not show.
I have no code, only the site's address. What can I do?
The JavaScript library vulnerabilities test works from a domain and reads the libraries the site sends to the browser. It cannot see server-side dependencies; those need a lockfile.

Primary sources

Related tools