Dependency Vulnerability Scan

What Is Scanned

The packageDependencies array in manifest.json declares other marketplace packages that this package requires. Each dependency is resolved to a specific version and checked for known CVEs.

// manifest.json excerpt:
{
  "packageDependencies": [
    { "packageId": "acme-corp/form-utils",       "versionRange": "^1.0.0" },
    { "packageId": "biz-corp/approval-commons",  "versionRange": ">=2.0.0 <3.0.0" }
  ]
}

Vulnerability Databases

DependencyVulnerabilityChecker — How It Works

public class DependencyVulnerabilityChecker : ISecurityCheck
{
    public async Task<IReadOnlyList<ScanFinding>> CheckAsync(
        PackageBundle bundle, ScanContext context, CancellationToken ct)
    {
        var findings = new List<ScanFinding>();

        foreach (var dep in bundle.Manifest.PackageDependencies)
        {
            // Resolve the specific version that satisfies the range
            var resolvedVersion = await _versionResolver.ResolveAsync(dep.PackageId, dep.VersionRange, ct);

            // Query all three databases in parallel
            var (nvdResults, osvResults, internalResults) = await (
                _nvdClient.QueryAsync(dep.PackageId, resolvedVersion, ct),
                _osvClient.QueryAsync(dep.PackageId, resolvedVersion, ct),
                _internalAdvisory.QueryAsync(dep.PackageId, resolvedVersion, ct)
            );

            foreach (var vuln in nvdResults.Concat(osvResults).Concat(internalResults))
            {
                findings.Add(new ScanFinding
                {
                    Check        = "DependencyVulnerability",
                    Severity     = MapCvssToSeverity(vuln.CvssScore),
                    ArtifactType = "PackageDependency",
                    ArtifactName = dep.PackageId,
                    Field        = "packageDependencies",
                    Value        = $"{dep.PackageId}@{resolvedVersion}",
                    Rule         = vuln.CveId,
                    Message      = $"Dependency '{dep.PackageId}' version '{resolvedVersion}' has {vuln.Severity} severity vulnerability {vuln.CveId}: {vuln.Description}"
                });
            }
        }
        return findings;
    }

    private Severity MapCvssToSeverity(double cvss) => cvss switch
    {
        >= 9.0 => Severity.Critical,
        >= 7.0 => Severity.High,
        >= 4.0 => Severity.Medium,
        _      => Severity.Low
    };
}

Severity Mapping

Scan Finding Example

{
  "check":    "DependencyVulnerability",
  "result":   "WARN",
  "severity": "Medium",
  "findings": [
    {
      "artifactType": "PackageDependency",
      "artifactName": "acme-corp/form-utils",
      "field":        "packageDependencies",
      "value":        "acme-corp/form-utils@1.0.0",
      "rule":         "CVE-2026-12345",
      "message":      "Dependency 'acme-corp/form-utils' version '1.0.0' has a Medium severity XSS vulnerability (CVE-2026-12345, CVSS 5.4). Update to version 1.0.1 or later to resolve. See: https://nvd.nist.gov/vuln/detail/CVE-2026-12345"
    }
  ]
}

Re-scanning Listed Packages

The marketplace performs a nightly re-scan of all listed packages using the latest vulnerability database snapshots. If a newly discovered CVE affects a listed package's dependencies:

• The package's scan badge is updated to WARN or FAIL
• The publisher receives an email notification with the CVE details and remediation guidance
• A FAIL re-scan suspends new installs of the package — existing installs continue working
• The publisher has 30 days to publish a new version with the vulnerability resolved before the package is unlisted