I built a CVE scanner for Python/Node with zero dependencies. Here's why that matters.

Most dependency scanners are themselves a dependency problem.

You install safety or pip-audit and suddenly you're pulling in 12 packages just to check if your 3 packages are safe. That always bothered me.

So I built Depheal. It scans your requirements.txt and package.json for known CVEs and abandoned packages — and it has zero dependencies. Pure Python stdlib. Nothing else.

pip install depheal

depwise scan .

What it actually does

Hits the OSV.dev API for real CVE data

Detects abandoned packages (no updates in 3+ years, deprecated, etc.)

Works on Python and Node projects

--strict flag exits with code 1 — great for CI pipelines

depwise why explains what's wrong with a specific package

Sample output from scanning my own project today:

"

Thanks for reading the full post.