New Relic Vulnerability Management doesn’t actually find vulnerabilities; it tells you which libraries your code is using, and then cross-references those against known CVEs.
Let’s say you’ve got a Node.js app running, and you’ve just deployed it. You’re using npm to manage your dependencies. New Relic’s Vulnerability Management feature, specifically the part that looks at your code’s dependencies, works by inspecting the package-lock.json (or npm-shrinkwrap.json) file in your application’s root directory. It then sends this list of dependencies, along with their exact versions, up to New Relic’s platform. New Relic maintains a database of Common Vulnerabilities and Exposures (CVEs) and their associated affected software versions. When your dependency list comes in, New Relic compares your versions against its CVE database. If a match is found – meaning a library you’re using has a known vulnerability at that specific version – it flags it.
Here’s a simple example of what that dependency list might look like in your package-lock.json:
{
"name": "my-node-app",
"version": "1.0.0",
"dependencies": {
"express": {
"version": "4.17.1",
"resolved": "https://registry.npmjs.org/express/-/express-4.17.1.tgz",
"integrity": "sha512-T0P0vT5d/r+7a5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w7t5fX+rFwE4b+v3B/w