vulnerability-checker

Yet another small Python utility to scan a folder for JavaScript lock files and report packages that match a provided vulnerability list. Partly hand-coded with small engineer fingers, partly vibecoded.

It checks package-lock.json and yarn.lock files, tries to find a match between installed packages and the vulnerability list, and shows a final report of potentially affected packages.

What it scans

• package-lock.json
• yarn.lock

The scanner walks the target folder recursively and skips node_modules directories.

Vulnerability list format

Input file example:

axios 1.8.4
axios <1.15.0
form-data 4.0.4 # optional trailing comment
# comment lines are ignored

Each active line should contain package-name vulnerable-version:

Supported version specs:

• 1.8.4 (exact match)
• <1.15.0
• <=1.15.0
• >1.0.0
• >=2.3.1

Run

python vulnerability-checker.py <target-folder> <vulnerability-list.txt> [--silent] [--debug]

--silent suppresses all progress output and prints only the final summary. Useful for CI pipelines. Exit codes still apply.

--debug prints each vulnerability check, discovered versions, and no-match reasons.

Exit codes

• 0: no vulnerable package/version pairs from the list were found
• 1: at least one vulnerable package/version pair was found

Self-tests

A small unittest suite is included in test_vulnerability_check.py.

Run:

python test_vulnerability_check.py

Or with unittest module:

python -m unittest -v test_vulnerability_check.py

Troubleshooting

• No lock files found: Use the correct target folder and ensure package-lock.json or yarn.lock exists under it.
• Expected match not reported: Verify vulnerability list format and version specs. For range rules like <1.15.0, the tool compares version numbers.
• Many lines but no findings: Check vulnerability file formatting. Each active line must be package-name plus version.
• Need more visibility: Run with --debug to see what package/version checks are happening.