SBOM Vulnerability Scanner Install in VS Code

VS CODE EXTENSION / SOFTWARE SUPPLY CHAIN

Know your components. See risks in your editor.

Generate a software bill of materials and check dependency vulnerabilities inside VS Code. Explore components, review available fixes, and export reports without leaving your development environment.

Install in VS Code ↗View on GitHub ↗

VS Code
Syft / Trivy / npm audit
HTML / JSON / Word

Workflow diagram showing tool preparation, dependency analysis, and HTML, JSON, and Word exports — Prepare → analyze → share. Official workflow illustration; coverage depends on the selected tools.

01 /

Explore connected components

Explore dependencies as lists or trees. Filter by name, version, license, or CVE, and distinguish direct from transitive dependencies.

02 /

Find what needs attention

Review known vulnerabilities by severity and available fixes. CISA KEV flags and license categories help guide triage.

03 /

Share for each audience

Explore HTML, integrate JSON, and deliver Word reports. Japanese output is supported, with scan status and coverage available for review.

01 / FEATURE TOUR

Explore what you can do.

SBOM VULNERABILITY SCANNER / 01

From your project to its dependencies.

Generate and scan with Syft and Trivy. npm projects can start with manifest and npm audit without either external scanner. Coverage depends on the selected tools and lockfile.

Read the guide on this page ↓

Three-stage SBOM scanning workflow — Official workflow diagram, rather than a screenshot of scan results.

SBOM VULNERABILITY SCANNER / 02

One assessment. Three ways to share.

Export component inventories and vulnerability findings as HTML, JSON, or Word. When multiple npm projects are detected, generate an overall summary alongside per-project reports.

Read the guide on this page ↓

Official illustration of HTML, JSON, and Word report formats — Official report-format illustration. Review the status when analysis fails or is skipped.

SBOM VULNERABILITY SCANNER / 03

Continue from findings to action.

Use package.json diagnostics and Quick Fix suggestions to review fixed versions. Suppression rules record reasons and expiry dates in reports. Reinstall dependencies and verify behavior after an update.

Read the guide on this page ↓

{
  "suppressions": [{
    "cveId": "CVE-2023-12345",
    "reason": "Review decision and supporting evidence",
    "expires": "2026-12-31"
  }]
}

Example .sbom-ignore.json format. Replace the CVE and rationale with your reviewed findings.

02 / FROM INPUT TO ACTION

A path from inspection to action.

Build an inventory

Extract dependencies into an inventory exportable as CycloneDX or SPDX.

Check known risks

Scan with Trivy or npm audit, then review severity, available fixes, and execution status.

Move to fixes and reporting

Review findings in the editor and share remediation decisions in reports.

03 / COVERAGE

Know the scope of your assessment.

npm & monorepos

Supports npm lockfiles and workspaces. Batch summaries preserve failed and skipped projects.

Other ecosystems

Coverage follows installed Syft and Trivy versions. Automatic setup requires tools such as Homebrew on macOS/Linux or WinGet on Windows.

04 / GET STARTED

Get started in three steps.

Install the extension

Install the extension in VS Code 1.90 or later and open a trusted local project.

Choose your tools

Open SBOM Scanner in the Activity Bar. For npm, choose manifest and npm-audit; otherwise prepare Syft and Trivy.

Scan and share

Generate and scan, review status and scope, then use the report exports available in your installed version.

START WITH YOUR PROJECT

Make review part of your everyday work.

SBOM Vulnerability Scanner

Install in VS Code ↗GitHub ↗

How data is handled

Analysis runs through the local extension and CLIs. npm audit sends dependency information to the configured registry; Trivy uses the network to update its database. Reports contain dependency names and target paths.

EXPLORE THE APPS / TIP