Dependency scan results and suggested fixes (OWASP CVE Lite CLI)

I ran a dependency scan on Madge while looking at tools that are commonly used to inspect dependency graphs in JavaScript projects.

For context, I’m the maintainer of an OWASP-adopted CLI called CVE Lite CLI. It focuses on scanning lockfiles locally and surfacing actionable fixes rather than just listing advisories.

The CLI uses the existing package-lock.json, so no setup or API keys are needed.

What stood out:

• 26 findings in total
• includes critical and high-severity issues
• most findings are transitive, but there is at least one clear high-severity parent upgrade path
• several findings involve common developer tooling dependencies such as minimatch, postcss, handlebars, and basic-ftp
• a number of advisory fixed-version hints required validation because earlier “fixed” versions were still vulnerable

The tool was able to suggest a concrete fix plan:

npm install @typescript-eslint/[email protected] [email protected]

A couple of examples:

• @typescript-eslint/[email protected] pulls in vulnerable [email protected]; upgrading to 8.52.0 removes that path
• [email protected] pulls in vulnerable [email protected]; upgrading to 8.5.0 removes that path
• [email protected] is flagged as critical, with the scan validating 5.3.0 as the lowest known non-vulnerable version
• [email protected] requires upgrading beyond the advisory hint, with 4.18.0 validated as the safer target version

One thing I found interesting is that advisory “fixed versions” are not always reliable. In a few cases, versions marked as fixed were still vulnerable, so the safe upgrade required additional validation.

CVE Lite CLI also has a GitHub Action, so this kind of scan can run locally during development or in CI as a lightweight dependency security check.

I’m not raising this as a strict issue to fix everything, more sharing the findings and the approach. Since Madge is used to inspect dependency graphs, this felt like a useful data point.

For reference, here’s a snapshot of the report view highlighting the findings and suggested fix paths:

Curious how you currently think about dependency security here, whether this kind of local check would be useful alongside existing tooling.

Happy to share more details if helpful.