The short answer: No. Supply Chain Defense finds malware in package files. It does not check package versions for known vulnerabilities. The two are different problems, and many customers use a tool for each.
Vulnerable vs. Malicious
A software supply chain problem usually comes in one of two forms:
A vulnerable package: legitimate code with a security flaw. An attacker could exploit it. Vulnerability scanners find these by comparing the package versions you have installed against a database of known vulnerabilities (CVEs), then tell you which version to update to.
A malicious or compromised package: code that is already harmful, for example a release published from a hijacked maintainer account or a tampered update. These often have no published vulnerability to match, because nothing is "broken"; the code is simply bad.
Supply Chain Defense handles the second case. It scans the files on disk, identifies malicious or compromised files regardless of their version number, and remediates them when protection is enabled.
What Supply Chain Defense Does Not Do
Check installed package versions against CVEs or security advisories
Tell you which packages are outdated or need upgrading
Rely on
package.jsonor lockfiles to determine packagesCheck license compliance
Block
npm install, deployments, or CI/CD pipelines
Should I Use Both?
Yes. A vulnerability scanner helps you keep packages patched so they're harder to exploit. Supply Chain Defense catches malicious code that gets onto the server anyway, including from packages that have no known vulnerability. They work at different layers and don't conflict.
💡 Using Patchstack? See Can I Use Monarx and Patchstack at the Same Time?