analyze_transitive_dependencies

io.github.salemalem/npmscan · Verify this server

Walk one or more root packages' dependency trees (e.g. a package.json "dependencies" section) up to `maxDepth` levels (default 2, max 3) and check every resolved package@version against OSV.dev, so vulnerabilities several levels down still surface. Read `summary` first; `vulnerablePaths` answers "which of my dependencies pulled this in"; `nodes` has the full graph. npm aliases are followed (`actualName`). Before calling a result clean: - A node with `resolutionError` (unsatisfiable range, 404, or a git/file/workspace/URL specifier) has `isVulnerable: null` — it was never scanned, not clean. - Only "dependencies" are followed (not dev/peer/optional). Each range is resolved independently to its max-satisfying version, so this shows which vulnerable versions are reachable, not npm's exact hoisted install. - The walk has a node budget: check `truncated`/`truncationNote`. Use batch_query_vulnerabilities instead when you already have a flat list of exact versions (faster, no graph walk).