Dependency audit

About

Shows what is outdated and what is vulnerable, and tells you which of those actually matters here.

Files in v1.0.0

• replicamd.plugin.json1049 B

Contributes

{
  "commands": [
    {
      "id": "audit",
      "title": "Audit dependencies",
      "prompt": "Run the audit for whichever ecosystem this project uses (`npm audit`, `bun audit`, `pip-audit`, `cargo audit`). Then do the part the tool cannot: for each advisory, check whether this project reaches the vulnerable code path at all. A high-severity advisory in a transitive dev-only dependency is usually noise; a moderate one in a request handler is not. Rank by real exposure and say which ones you would actually act on."
    },
    {
      "id": "outdated",
      "title": "What is outdated",
      "run": "npm outdated || bun outdated || true"
    }
  ]
}

Versions

• v1.0.07/26/2026 · 1 files

Install

Nothing happened? ReplicaMD may not be installed yet - or open it first, then Settings → Plugins and install by id.

Plugin id:

Bundle endpoint: