Open-Source Dependency Vulnerability Drift Monitor

Abstract

This paper presents an Open-Source Dependency Vulnerability Drift Monitor , an automated security monitoring platform designed to continuously track software dependencies for known vulnerabilities and version inconsistencies. Most existing vulnerability scanning tools provide only one-time analysis and fail to address the continuous evolution of dependencies, leaving systems exposed to newly discovered threats.
For development teams, the system provides automated dependency scanning, real-time vulnerability detection using the OSV database, version drift analysis, and prioritized security alerts. For individual developers, the platform offers a centralized dashboard for monitoring multiple projects with detailed CVE information and remediation guidance.
The system includes features such as automated dependency extraction, vulnerability detection, version drift monitoring, risk-based alert generation, and scheduled background scanning. It was evaluated with real-world npm and Python projects, achieving over 90% accuracy in vulnerability detection and successfully identifying outdated dependencies across all tested scenarios