Lockfile vulnerability checker

Paste a package-lock.json (or a list of name@version lines) and see which installed packages have known vulnerabilities, with the fixed version. It runs in your browser.

What leaves your browser. For each package, its name and version are sent to OSV.dev (Google's open vulnerability database) from your browser, to look up advisories. Nothing is sent to Dynv, and your lockfile is not uploaded. If your lockfile has private package names, tick "Skip scoped packages" first, because scoped names would also be sent.

package-lock.json or name@version lines Skip scoped packages (@scope/name)

How to read the result

Listed does not mean exploitable. An advisory applies to a version range; whether your app reaches the vulnerable code is a separate question.
The lockfile is what you declared, not what runs. Check the deployed container too; this guide shows how.
Fixed version is the first version OSV lists as fixed for that package, which may be a major bump.
Entries starting MAL- are OSV's records of malicious packages. Treat the machine and its secrets as exposed and rotate.

Dynv's own vulnerability monitoring does the same lookup for the packages your running services actually have installed, and dynv scan does it for CI.