Dependency security guides

Practical, tested guides to finding, prioritising and fixing vulnerable and malicious dependencies.

• How to find vulnerable packages in composer.lock, and which to fix first

  Use composer audit to list known vulnerabilities in a PHP project, read what it tells you, trace transitive packages, and decide what to upgrade first.

  Oct 30, 2026

• Malicious packages, how they work and how to catch them

  Malicious packages don't have bugs, they are the attack. How they get into projects, why install scripts matter, how to check your lockfile against known malicious versions, and what to do if you find one.

  Oct 30, 2026

• Which vulnerable dependencies to fix first, using CISA KEV and EPSS

  CVSS tells you how bad a vulnerability could be, not whether anyone is exploiting it. Here is how to add CISA's Known Exploited Vulnerabilities catalog and FIRST's EPSS scores to your triage, with commands you can run today.

  Oct 30, 2026