Skip to content
Liel AlmogSoftware engineer

Application security · Developer tooling

Package Vulnerability Detector

A NestJS API that analyzes package definition files and retrieves known vulnerabilities through GitHub’s Security Advisories GraphQL API.

View repository

Why I built it

My curiosity extends to the tools developers rely on every day. This project brings together backend API design and security to make dependency risks easier to investigate.

Engineering approach

The NestJS API accepts package definition files, parses their dependencies, and validates requests before looking up advisory data. It uses GitHub’s Security Advisories GraphQL API as the source of known vulnerabilities.

Results connect packages to relevant advisories so developers can investigate dependency risk. The service is packaged with Docker and keeps the parsing, external lookup, and result handling behind a clear API boundary.

How Package Vulnerability Detector works

Explore the main parts of the project and how they fit together.

Inside the system

  1. Package definition files supply the dependencies to inspect for known vulnerabilities.

  2. A structured API parses input, validates requests, and coordinates advisory lookups.

  3. GitHub’s Security Advisories GraphQL API supplies known vulnerability records for the packages under analysis.

  4. Results connect affected dependencies with known advisories so developers can investigate and act.