NPM Package Vulnerability Scanner for Web3 Libraries

WHAT IT DOES NPM Package Vulnerability Scanner for Web3 Libraries is a security-focused tool that scans npm package.json files for known vulnerabilities in Web3-related libraries. It parses the package.json dependencies, optionally resolves exact versions from package-lock.json, and checks each package against a curated vulnerability database. The database includes vulnerabilities for common Web3 packages such as ethers, web3.js, @openzeppelin/contracts, hardhat, @chainlink/contracts, @uniswap/v2-core, @uniswap/v3-core, @aave/core-v3, and more. For each vulnerability found, the tool displays the package name, version, severity level (critical, high, medium, low, or info), description, and remediation recommendations. The tool also accepts optional Solidity source code to identify which dependencies are actually used in the contract, providing context for prioritizing fixes. HOW TO USE Paste your package.json into the "package.json" text area. Optionally paste your package-lock.json for exact version resolution, and your Solidity source code for context. Click "Scan vulnerabilities" to analyze the dependencies. The tool will display a summary with total packages scanned, safe packages, and counts by severity (critical, high, medium, low, info, unknown). A detailed vulnerability report shows each package with its version, severity, description, and recommendation. Packages detected in the Solidity source are marked as "Used in contract source" for prioritization. TECHNICAL NOTE: VERSION RESOLUTION AND VULNERABILITY MAPPING The tool uses a multi-stage version resolution process. It first parses the package.json to extract dependency names and version ranges. When a package-lock.json is provided, the tool extracts exact installed versions from the lock file, prioritizing these over the package.json ranges. The tool then checks each package against the vulnerability database, which is curated specifically for Web3-related packages. Version matching supports range operators () and range notation (x-y). For each vulnerability, the tool maps the severity to a color-coded label and provides detailed remediation guidance. The tool also integrates optional source code analysis to detect which packages are imported in the contract, helping developers prioritize vulnerability fixes based on actual contract usage. WHAT IT CANNOT SEE The tool cannot automatically detect dependencies without package.json or lock files. It is limited to the accuracy of the vulnerability database; it may not include all vulnerabilities for all packages. It cannot detect vulnerabilities in private or unpublished packages that are not in the database. It cannot verify that reported vulnerabilities are exploitable in the specific contract context; the presence of a vulnerability does not guarantee it is exploitable. It cannot scan non-npm dependencies such as Git submodules or local packages. The tool is limited by the accuracy of version resolution from lock files. It cannot detect vulnerabilities in transitive dependencies without a full lock file. It cannot scan dependencies for non-EVM chains. PLEASE NOTE This tool is designed exclusively for npm packages used in Web3 and Solidity development on EVM-compatible chains. The vulnerability database is curated and may not be comprehensive. The scan results are based on package versions and known vulnerability patterns; they do not constitute a complete security audit. Always verify critical findings against official security advisories and use additional security tools. The tool provides no warranty that the scan results are complete or accurate; users are responsible for verifying all dependencies and security issues.