Know every open-source library running in production.
Library Scanner fingerprints the OSS packages behind your public services, matches them against CVE and GHSA feeds, and surfaces exposed dependencies — without ever seeing your source code.
You can't patch what you can't see
Modern services depend on hundreds of transitive open-source libraries. Most teams don't know which versions ship to production. Library Scanner rebuilds the SBOM from the outside — fingerprinting frameworks, JS bundles, server signatures, and error responses — then matches every package against public vulnerability feeds.
How External Software Composition Analysis Works
FINGERPRINT
Detect frameworks (React, Vue, Next.js, Rails, Spring), server versions, JS bundle contents, and error fingerprints.
MATCH
Every detected package is cross-checked against NVD, GHSA, and ecosystem advisories hourly.
ALERT
Vulnerable dependencies surface with fix versions and CVE evidence.
Key Features & Core Architecture
Multi-ecosystem
npm, PyPI, RubyGems, Maven, NuGet, Go modules, Debian/Ubuntu packages.
Bundle-aware
Reconstructs JS bundle library versions even when they aren't in a manifest.
Transitive coverage
Not just direct deps — flags vulnerable transitives too.
Exportable SBOM
CycloneDX and SPDX exports for supplier and regulator handoff.
Ticketing integration
One deduped ticket per vulnerable package per service.
Detected libraries with known CVEs
| Sr. No. | Service | Package | Version | Fix version | CVE | Severity |
|---|---|---|---|---|---|---|
| 1 | api.example.com | lodash | 4.17.15 | 4.17.21 | CVE-2021-23337 | High |
| 2 | web.example.com | react | 18.1.0 | — | — | Clean |
| 3 | checkout.example.com | openssl | 1.1.1t | 1.1.1w | CVE-2023-5678 | Critical |
Seamless Output Destinations
Stream threat signals directly into your existing security workflow and ticketing systems.
Jira
Automated ticket routing
Webhook / SIEM
Event webhooks
CycloneDX / SPDX
Standard SBOM formats
Slack
Critical vulnerability alerts
Built for Every Security Role
SBOM validation
Prove the SBOM your build system produces matches what's actually deployed.
Vendor risk
Get a per-vendor SBOM without asking the vendor.
Log4Shell drills
Answer 'are we exposed to X?' in minutes, not a company-wide audit.
Frequently Asked Questions
Every library, every version, every CVE.
Get a Library Scanner report on your production services without touching a single repo.