Look-See: Find Known Vulnerabilities in Your Dependencies
Software is built on software. A project may depend on dozens or hundreds of packages, and a newly disclosed flaw in one of them can affect applications that never changed their own code. The CVE Program's annual metrics show the number of published vulnerability records rising over time. Keeping track of what your project actually uses is one useful part of staying ahead.
That is why I built Look-See, a small command-line tool that checks supported dependency files against vulnerability data and produces reports you can review. Here is a quick look at it:
The sample findings shown in the video are illustrative; they are not from a live scan.
What it checks
Look-See currently reads npm lockfiles (package-lock.json, pnpm-lock.yaml, and yarn.lock), Go go.mod files, and Python pinned or unpinned requirements.txt files. It uses OSV for package-aware advisory matching, checks resolved npm, Go, and pinned Python package versions against cve.now, and enriches CVE findings with NVD details. The reports include scan coverage, so missing or unsupported inputs and advisory-source errors are visible.
Look-See only reads the project files. It does not install packages or change your project, and it does not apply automatic fixes. Treat a finding as a prompt to investigate and update deliberately: verify the affected package and version, review the advisory's references and affected range, then upgrade to a patched version recommended by the package maintainer. Run your project's tests and deploy through your normal process.
Scan a project
You need Node.js 22 or newer. From the project you want to check, run:
npx @shubhambattoo/look-see .
Or provide any project directory explicitly:
npx @shubhambattoo/look-see /path/to/project
The command checks supported files recursively and, by default, opens an HTML report. It also writes look-see-output.html and look-see-output.json to <project>/.look-see/.
If you prefer the look-see command available globally, install it once and scan a directory:
npm install --global @shubhambattoo/look-see look-see /path/to/project
Useful options include:
# Write reports to a chosen directory look-see . --out ./security-reports # Generate JSON only, without opening a browser look-see . --format json --no-open # Skip NVD enrichment look-see . --no-nvd # Exit with status 1 if a high or critical finding is reported look-see . --fail-on high
Review and act on the report
Start with the HTML report for a readable summary, then use the JSON report if you want to process findings elsewhere. For each result, check the package coordinate, resolved version, advisory details, affected range, and references. Prioritize confirmed version matches; package-only results for dependencies without a known resolved version are marked as potential and need manual verification. Also check the coverage section before treating a scan as clean: an unavailable advisory service or unsupported dependency file can leave gaps.
Then consult the maintainer's release notes or advisory for a patched version, update the dependency through your usual workflow, and run your tests. Re-scan after the change to confirm what remains. Look-See helps surface the work; the final upgrade and validation stay in your hands.