OWASP [1] maintains npm, maven (and nuget, I believe) plugins for detecting use of packages with known vulnerabilities, and a vulnerability db, of course. [1]:

OWASP [1] maintains npm, maven (and nuget, I believe) plugins for detecting use of packages with known vulnerabilities, and a vulnerability db, of course. [1]: https://www.owasp.org/ https://www.owasp.org/