Manifest input
Paste the contents of a package.json file, drop a file in the box, or load the demo manifest.
What this does
The pipeline resolves your dependencies, fetches CVEs from the National Vulnerability Database, scores each finding, and asks Gemini for a stakeholder-facing impact summary on high-risk items.
Tips for a clean run
- The dependency tree is capped at 200 nodes / depth 3 for the demo.
- For real npm packages the request takes 30–90 seconds end-to-end because of NVD lookups + Gemini calls. The UI stays responsive.
- If you paste empty or invalid JSON, the server falls back to a built-in demo manifest so the demo never breaks.
- Direct dependencies are drawn with a black border; transitive deps are smaller and unbordered.
Risk score breakdown
- CVSS (40% weight) — base severity from NVD.
- In-context exploitability (35%) — Gemini's read of whether the bug is reachable in this package's typical use.
- Blast radius (25%) — how many packages transitively depend on this one.
- Critical path boost (+15) — bonus if a directly-installed package depends on it.
Analyzing dependency graph…
Resolving transitive deps, querying NVD, scoring risk with Gemini.
No findings / low risk (<30)
Medium (30-60)
High (60-100)
Bordered nodes = direct dependencies