Your Dependency Tree Is Your Attack Surface
A twelve-line utility can pull in ninety packages. Every one of them runs with your privileges.
You add a twelve-line utility package. It pulls in six dependencies, which pull in eighty more. Every one of those runs with your application's privileges, and you reviewed none of them.
That is not a criticism of anyone's discipline. It is the shape of modern development, and the only reasonable response is to know what is actually in there.
What OSV-Scanner does
It reads your lockfiles and checks them against the OSV database, which aggregates advisories across ecosystems — npm, PyPI, Go, Maven, crates and more — with structured version ranges rather than prose.
osv-scanner --lockfile package-lock.json
osv-scanner -r ./ # walk a directory treeLockfiles matter here. Scanning package.json tells you what you asked for; scanning the lockfile tells you what you got, which is the thing actually running.
Why not just npm audit
Use both. npm audit is convenient and npm-only, and its severity ratings have a reputation for being noisy. OSV covers every ecosystem in a polyglot repository — and my client projects routinely have a Node frontend, a Python service, and a Go tool in one place.
One scanner across all of them, with consistent output, is worth the extra step in CI.
Reducing the surface instead of just measuring it
Scanning tells you about vulnerabilities. It does not reduce them. The things that do:
Question every new dependency. Is this thirty lines you could write and own? A lot of packages are.
Check maintenance before adding. Last publish date, open issue count, number of maintainers. An unmaintained package is a vulnerability with a delay.
Look at the transitive count. A package with eighty dependencies is eighty trust decisions you are making at once.
Prefer the platform. Modern runtimes and browsers cover a lot of what small utility packages used to exist for.
In practice
Run it on every pull request and on a schedule — a package you have not touched can become vulnerable while you sleep, and only the scheduled run catches that.
Then triage like any other finding: reachable code first, fixes available first, and an honest note for anything you consciously accept.
Resources
- Repo: google/osv-scanner
- Database: osv.dev
- Video walkthroughs: YouTube: OSV Scanner tutorial
- Inventory first: An SBOM is just an honest inventory
Need this built properly?
I build secure, fast, bilingual platforms for clients across Egypt, Saudi Arabia, the UAE and Kuwait.
