depchecklisted

# Dependency Analysis with Socket Use the [Socket CLI](https://docs.socket.dev/docs/socket-cli) (`@socketsecurity/cli`) to check for CVEs in direct and transitive dependencies. Also covers native audit commands for npm, yarn, pnpm, bun, and Python/uv. ## Prerequisites ```bash npm install -g @socketsecurity/cli socket login # or: export SOCKET_SECURITY_API_TOKEN=<token> ``` ## Check a single package for CVEs ```bash socket package score npm <package> --markdown # deep (includes transitives) socket package shallow npm <package> # shallow (package only) socket package shallow npm react lodash eslint # multiple packages socket package score pypi <package> --markdown # Python/PyPI deep score socket package shallow pypi <package> # Python/PyPI shallow score ``` ## Check a project for CVEs ```bash socket scan create <dir> --report # full scan socket ci # CI gate (non-zero on failure) socket scan create . --json | jq '.alerts[] | select(.severity == "critical")' ``` ## Native audit commands (no Socket required) No lockfile? Use `npx audit-ci --high`. ### npm ```bash npm audit --audit-level=high npm audit --json | jq '.vulnerabilities | to_entries[] | select(.value.severity == "high" or .value.severity == "critical")' ``` ### yarn v1 ```bash yarn audit --level high ``` ### yarn v4+ (berry) ```bash yarn npm audit --all --severity high ``` ### pnpm ```bash pnpm audit --audit-level