IBM trackRepo scanner · the model behind our Top 500
Which of your dependencies will attackers hit next?
Give us a GitHub repo or a lockfile. We find every known CVE in your exact versions, flag the ones already being exploited, and rank the rest by how likely they are to join CISA's exploited list. You get one upgrade per package, in priority order.
Only reads lockfiles
Runs in your browser
About 10 seconds
ModeDeps scan
LiveOSV · KEV
Threats3
Sources6
How a scan works
Five steps, each one a stage of the Top 500 pipeline. Click any step for the details.
Scan
Pick how you want to give us the dependencies.
github.com/
Public repos only. Your browser reads up to 8 package-lock.json /
requirements.txt files from the default branch through GitHub's API. Nothing is cloned or stored.
Sheridan Datathon 2026 · public repos
IBM open source · archived
Paste a lockfile
Results show up on this page. Nothing is saved.
How the model works
Zoom out to the whole pipeline: the data, the clues, the three judges and how we picked our Top 500. Every score on this page comes from it.