Depcheck

Dependency Analysis with Socket

Uses the Socket CLI (@socketsecurity/cli) to check for CVEs in direct and transitive dependencies. Also covers native audit commands for npm, yarn, pnpm, and bun.

Prerequisites

npm install -g @socketsecurity/cli
socket login   # or: export SOCKET_SECURITY_API_TOKEN=<token>

Check a single package for CVEs

socket package score npm <package> --markdown     # deep (includes transitives)
socket package shallow npm <package>              # shallow (package only)
socket package shallow npm react lodash eslint    # multiple packages

Check a project for CVEs

socket scan create <dir> --report                # full scan
socket ci                                        # CI gate (non-zero on failure)
socket scan create . --json | jq '.alerts[] | select(.severity == "critical")'

Native audit commands (no Socket required)

npm

npm audit --audit-level=high
npm audit --json | jq '.vulnerabilities | to_entries[] | select(.value.severity == "high" or .value.severity == "critical")'

yarn v1

yarn audit --level high

yarn v4+ (berry)

yarn npm audit --all --severity high

pnpm

pnpm audit --audit-level=high
pnpm audit --audit-level=medium     # include medium-severity CVEs
pnpm audit --fix                    # write overrides to pnpm-workspace.yaml

bun

bun audit --audit-level high

ad-hoc (no lockfile)

npx audit-ci --high

Secure install wrapper

socket npm install           # drop-in npm replacement with scanning
socket npx <package>         # scans before executing
socket wrapper --on/--off    # toggle globally

Pin dependency versions

All dependencies in package.json MUST be pinned to exact versions. No semver ranges (^, ~, *, >, <, >=, <=). Applies to dependencies, devDependencies, peerDependencies, and optionalDependencies.

Why

• Prevents unexpected breaking changes from transitive updates.
• Ensures reproducible builds across environments and CI.
• Mitigates supply-chain attacks via malicious package updates.

Good

{
  "dependencies": {
    "astro": "6.4.2",
    "tailwindcss": "4.3.0"
  },
  "devDependencies": {
    "wrangler": "4.95.0"
  }
}

Bad

{
  "dependencies": {
    "astro": "^6.4.2",
    "tailwindcss": "~4.3.0"
  }
}

Adding or updating

• When installing a new dependency, pin it to the exact installed version.
• To bump a pinned dependency:
  1. Run pnpm up <package> to fetch the latest version.
  2. Manually update package.json to the new exact version.
  3. Run pnpm install to update the lockfile.

Pin GitHub Actions to commit SHAs

All GitHub Actions MUST be referenced by their full commit SHA, NOT by version tags or branch names. Applies to every uses: directive in workflows.

Why

• Tags can be moved or deleted; SHAs are immutable.
• Prevents supply-chain attacks via compromised action tags.
• Ensures CI runs the exact same code every time.

Good

- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- uses: pnpm/action-setup@a7487c7e895a8d0e9b3b8e8f3b8b8b8b8b8b8b8b # v4.0.0

Bad

- uses: actions/checkout@v4
- uses: pnpm/action-setup@v4
- uses: actions/checkout@main

Finding SHAs

Use git ls-remote https://github.com/<owner>/<repo> refs/tags/<version>, or open the action's releases page on GitHub, click the tag, and copy the 40-character commit SHA. Keep the version tag as a trailing comment for readability.

Set minimum release cooldown period

Set minimumReleaseAge of 7 days in workspace or lockfiles.

References

• Socket CLI docs — full command reference, score interpretation, alert severity levels
• Socket package scores — scoring dimensions and methodology
• Alert types — CVE, supply chain, quality, maintenance, license alerts