Dependency Monitoring

Monitor project dependencies for vulnerabilities, abandonment, and license changes.

Dependency Monitoring

Massu monitors your project dependencies for security vulnerabilities, maintainer abandonment, and license changes.

How It Works

When dependencies are synced to Massu, the system periodically checks each package against:

  • OSV Database — Open Source Vulnerability database for known CVEs
  • npm Registry — Package metadata including publish dates, license, and download stats

Alert Types

Alert TypeDescriptionSeverity
CVEKnown vulnerability discoveredCritical/High
StaleNo updates published in 12+ monthsMedium
License ChangePackage license has changedHigh
DeprecatedPackage marked as deprecatedMedium
Major UpdateMajor version availableLow

Risk Scores

Each dependency receives a risk score (0-100) based on:

  • Number and severity of vulnerabilities
  • Time since last publish
  • License changes
  • Download trends

Dashboard

View all monitored dependencies in the Dependencies Dashboard with filtering by risk level, alert status, and staleness.