Real-time, shift-left dependency vulnerability scanning for package.json, powered by OSV.dev.
Detects vulnerabilities in both direct dependencies and every transitive package installed under them, and attributes the risk back to the top-level entry in package.json that owns it.
Features
🛡️ Inline diagnostics on the exact version string of each vulnerable dependency
🔗 Deep scanning of the entire installed tree via npm ls --all --json
🧭 Transitive vulnerabilities surfaced on the direct dep that pulls them in, with the full dependency path
💡 Quick-fix upgrade action for direct-dep vulnerabilities
🖱️ Rich hover cards with CVE ids, severity, aliases and OSV.dev links
⚡ LRU-cached OSV batch queries and lockfile-keyed dep-tree cache
Requirements
Node.js and npm available on PATH (used to gather the installed dep tree)
Project must have run npm install at least once so npm ls can resolve versions
Settings
Setting
Default
Description
fmd.debounceMs
750
Debounce interval before a scan runs after edits
fmd.cacheSize
1000
LRU cache size for package/version lookups
fmd.scanTransitive
true
Scan the full npm ls tree, not just direct deps
fmd.npmLsTimeoutMs
20000
Timeout for the npm ls invocation
Commands
Flaw Mining Disorder: Show Logs — reveal the extension output channel
Flaw Mining Disorder: Rescan Active package.json — force a fresh scan and drop the cached dep tree
