dependency-vet

Dependency vet

When to use

• Before adding any new dependency, or suggesting one in an answer.
• When a dependency is replaced, or its source changes (new scope, fork, git URL).
• When core/supply-chain tells you to check a package.

Version upgrades of existing dependencies go through security-audit or cve-check instead.

Before you start

• Get the exact package name, ecosystem and the version you intend to add. Never vet a name you aren't sure of; ask the user.
• Ask what the package is for. You need this for the "already covered" check.
• These checks read public registry APIs over the network. They never install or run the package.
• The examples use curl and jq. If jq isn't installed, read the JSON directly.

Steps

1. Check whether you need it at all. Search the codebase and the existing manifest for something that already does the job, and check the language's standard library. If either covers the need, recommend that and stop.

2. Confirm it exists under exactly this name. Query the registry (commands below). A 404 means it doesn't exist: never add it, and tell the user the name may be hallucinated. Existing isn't enough: attackers and defenders both register commonly hallucinated names (for example, react-codeshift is now a placeholder package).

3. Check for typosquats. Compare the name with well-known packages that do the same job. Be suspicious of a one- or two-character difference, swapped or added separators (-, _, .), a missing or different scope, or a "-js"/"-py" suffix variant of a popular name. For npm, search for nearby names and compare downloads:

   curl -s "https://registry.npmjs.org/-/v1/search?text=crypto-js&size=5" | jq -r '.objects[] | "\(.package.name)\t\(.downloads.weekly // "?")"'
   

4. Check for known malware and advisories (the version-less query returns every advisory, including MAL- malware entries):

   curl -s -X POST https://api.osv.dev/v1/query \
     -d '{"package":{"name":"PACKAGE","ecosystem":"npm"}}' | jq -r '.vulns[]? | "\(.id) \(.summary // "")"'