Scan your dependencies for known vulnerabilities.
Drop a lockfile and see the CVEs and malicious packages hiding in your tree — checked against an OSV-backed mirror of 178k+ CVEsacross npm, Python, Go, Rust, and Ruby. It's parsed in your browser: only package names and versions are sent.
🔒 Parsed in your browser — only package names & versions are sent. Your lockfile never leaves this page.
Questions, answered
Is the dependency scanner free, and do I need an account?
Yes — the scanner is completely free and needs no signup, API key, or login. Drop a lockfile and you get results immediately. It is the same engine as the bumper CLI and the GitHub Action, just exposed as a browser tool.
Does my lockfile or source code get uploaded?
No. The lockfile is parsed in your browser; only the resolved package names and versions are sent to the hosted Advisor to look up CVEs and known-malicious packages. Your source code, full lockfile, and project never leave your machine.
Which package managers and ecosystems are supported?
bumper reads package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, go.sum, Cargo.lock, and Gemfile.lock — covering npm, Python, Go, Rust, and Ruby. Findings are checked against an OSV-backed mirror of 178k+ CVEs plus a known-malicious-package feed.
A one-off scan is a snapshot. Catch the next one automatically.
The same engine runs in your terminal and your coding agent — block known-malicious installs before they run, and surface vulnerable dependencies as you add them. Explore the Advisor MCP and API.