Deps Audit
Scan Node.js projects in your VS Code or Cursor workspace for vulnerable, outdated, and malware-flagged dependencies. Findings are grouped by repo in a sidebar. Optional Google Chat digests are configured in settings and never auto-send on a manual scan.
Install
Option A — VSIX (GitHub Release)
- Download
deps-audit-*.vsix from Releases
- Command Palette → Extensions: Install from VSIX…
Option B — from source
git clone https://github.com/figuesosa/deps-audit.git
cd deps-audit
npm install
npm run compile
npm run package
Then install the generated .vsix, or press F5 to launch an Extension Development Host.
Usage
- Open a folder that contains one or more Node projects (
package.json)
- Open the Deps Audit view in the activity bar
- Click refresh to scan
Useful commands:
| Command |
What it does |
| Deps Audit: Scan workspace |
Run a full scan |
| Deps Audit: Preview Chat digest |
Show the message in the Output panel |
| Deps Audit: Post digest to Google Chat |
POST only when you choose |
| Deps Audit: Open Settings |
Webhook, schedule, digest controls |
| Deps Audit: How to guide |
In-editor docs |
Features
- npm / yarn / pnpm audit + outdated majors + OSV malware signals
- Tree UI: Critical, High, Moderate, Low, Malware, Outdated
- Advisory dedupe (same GHSA/CVE/URL collapsed)
- Schedules: every N minutes, daily, weekly, or monthly (while the editor is open)
- Chat digests with controllable detail and length
Settings
| Setting |
Purpose |
depsAudit.webhookUrl |
Google Chat incoming webhook |
depsAudit.chatDetail |
summary · flagged · full |
depsAudit.scheduleMode |
off · everyMinutes · daily · weekly · monthly |
depsAudit.notifyOn |
Severities that flag a repo |
Full walkthrough: docs/HOWTO.md
Severity rules: docs/SEVERITY.md
Privacy
- Scans run locally against folders already on disk
- No telemetry
- Chat posts only when you post (or enable optional post-after-periodic)
CLI
npm install
node bin/cli.js --repo-dir ../my-app --dry-run
Multi-repo config: copy/edit repos.json, then:
node bin/cli.js --config repos.json --dry-run
Webhook (optional): set GOOGLE_CHAT_WEBHOOK.
GitHub Actions (optional)
.github/workflows/deps-audit.yml is manual-only by default (workflow_dispatch). Edit repos.json, add secrets AUDIT_REPOS_PAT and optionally GOOGLE_CHAT_WEBHOOK, then run the workflow. Uncomment the schedule cron if you want weekly runs.
Develop
npm install
npm run compile
npm run watch # optional
npm run package # builds deps-audit-<version>.vsix
License
MIT © David Figueroa
