🌐 Project site & docs →

Features

• 10 ecosystems in one pass; Maven, Gradle, npm/Yarn/pnpm, Composer, PyPI, NuGet, Go, Ruby — plus vendored JS, committed native binaries (identified by checksum) and embedded JARs (fat-jars/war/ear, opened in-memory).
• No build tools; manifests and lockfiles are read off disk. No mvn/gradle/npm install/pip/dotnet restore/go build, no node_modules/. The Maven graph is resolved the way Maven resolves it. → how
• CVE, merged & prioritised; CVEProject + OSV.dev + NVD, CPE/version cross-checked to cut false positives, ranked CISA KEV → EPSS → CVSS.
• Beyond CVEs; EOL and out-of-active-support frameworks, deprecated/abandoned/yanked, outdated with release dates, SPDX licenses, and private/internal packages — every coordinate no configured registry knows, in any ecosystem.
• Crypto material; committed certificates (expiry, weak key, weak signature, self-signed), private vs public keys across PEM/OpenSSH/PuTTY/PGP and JKS/PKCS#12 keystores. Parsed offline, no network.
• Air-gapped; zero network under --offline, regression-tested and reproducible under unshare -rn. On Maven it recovers 657/657 of OSV-Scanner's online result with no network interface at all, against 45 / 40 / 37 for the others. → Benchmark · Air-gapped
• Supply-chain risk; known-malicious advisories (always block the CI gate) and suspected typosquats (--typosquat).
• Audit-grade; every report carries a provenance manifest and a Methodology & limitations chapter; artifacts ship SHA256SUMS; differential audits diff against a prior run (--baseline) and CI can gate on new findings only.
• A --help that fits a screen; the long tail of switches folds into four flags — -d eol,nvd turns things off, -a licenses,snyk turns on what is off by default, -r html,json picks the outputs, -o says where. The individual flags still work and --help-all lists them.
• Reports in English or French (--lang fr)
• Outputs & CI; HTML + findings JSON by default (Word .doc on --report-doc), CycloneDX 1.6 SBOM, CSAF 2.0 VEX, SARIF 2.1.0, JSON; gate with --fail-on, triage with --ignore/--vex. Private registries for every ecosystem.

📖 Usage & all flags · Architecture · Comparison vs other tools · Data sources

Why use fad-checker for code audits?

What it does for an audit that the others don't. Same column set and sourcing discipline as docs/COMPARISON.md — ⚠️ is partial and says how, cells are meant to be checkable.

¹ No mvn/go/npm/pip/dotnet — manifests parsed off disk, nothing installed or executed. 105 × pom.xml in one pass: 790 pairs vs OSV-Scanner's 657, 133 fad-only, versions mediated per module not flattened.

² 657 of 657 of OSV-Scanner's online Maven result, under unshare -rn — no network interface. Tripwire-tested; only public coordinates ever leave the enclave.

³ Chapter 0 names every coordinate that every configured registry answered 404 for — Maven, npm, PyPI, NuGet, Composer, Go and RubyGems — with the manifest(s) declaring it. A registry that timed out or errored is never counted: an inconclusive answer would otherwise accuse a client of shipping internal packages because their proxy was flaky. -e <regex> then excludes them.

⁴ -t <dir>: normalised POMs plus every non-Maven lockfile mirrored, private coordinates stripped. Archivable, and scannable by anything — --snyk included.

⁵ endoflife.date, split direct vs transitive so you know which dep to bump, plus deprecated / abandoned / yanked and outdated. Trivy covers OS distros only; Snyk's package health is web-only.

⁶ Inventory and verdicts: expiry, RSA<2048, MD5/SHA1, self-signed; private vs public keys; JKS/PKCS#12. Offline parser. Trivy's secret rule finds the file, not the flaw.

⁷ Identified by hash via deps.dev + CIRCL → should-be-declared / name≠checksum / unknown / malicious. Syft's patterns name a version, not an identity.

⁸ Chapter 0 flags what this scan couldn't reach (missing lockfiles, BOM-only versions, Yarn Berry, undeterminable PHP runtime); chapter 6.3 states what the tool never assesses. Elsewhere the first is a log line the audit never sees, the second isn't written down.

⁹ Provenance manifest: tool, runtime, mode, run configuration and cache freshness for all 13 sources. Grype and Dependency-Check carry one source's date, not the run.

¹⁰ Chapters 0→6 with an executive summary and fix recipes, self-contained HTML plus a Word .doc twin. None of the others emits Word.

¹¹ Four inline-SVG charts — CWE by worst severity, vulnerable transitives per root dep, your most vulnerable modules (direct vs transitive on a single-module project), fix-priority bands — rendered in the .doc too, with one-click copy as PNG (or a table as rich HTML) that pastes into Word formatted. Every CVE keeps its CVSS vector, CWE, references, CPE config and via-path behind a drill-down, with zero external assets.

¹² --baseline adds a Δ chapter (new / fixed / unchanged); --fail-on-new gates on new findings only. Snyk tracks this on its platform, not as a local diff.

Where it loses — containers/OS packages, auto-fix PRs, and CVE coverage against Snyk's curated feed → docs/COMPARISON.md · the gap, measured.

Deliberately not a goal: reachability. A finding is a vulnerable version on the dependency graph, and the report says exactly that (ch. 6.3) instead of guessing at call paths. Deciding whether the vulnerable code is reachable in this application is the auditor's call, made with application context no scanner has.

[!WARNING] fad-checker is new and may still contain ( rare ) bugs. Treat its output as a strong first pass, double-check anything critical, and please report issues; they get fixed fast.

Quick start

A free NVD API key (instant) gives 10× faster enrichment: fad-checker --set-nvd-key YOUR_KEY. A few common runs; full list via fad-checker --help or docs/USAGE.md:

What -t <dir> actually does. It is an extraction step, not a Snyk adapter. It writes a parallel tree of normalised dependency descriptors: every pom.xml reduced to the dependency-relevant nodes (coordinates, properties, dependencyManagement, dependencies, modules), reactor parents rewired to their real in-tree relativePath, ${…} resolved in coordinates — plus every non-Maven lockfile/manifest mirrored at the same relative path (package-lock/yarn.lock/pnpm-lock, composer.lock, poetry/Pipfile/uv/pdm, *.csproj/packages.lock.json, go.mod/go.sum, Gemfile.lock, and companions like Directory.Packages.props or nuget.config). Online it also probes every coordinate against the configured Maven repositories and reports the ones that don't exist there — your private/internal modules — which -e <regex> then strips from the rewritten POMs. Then it stops: no CVE/EOL pass and no report unless you also pass --snyk, a --report-<type>, --fail-on* or --baseline. What you get is a buildless, sanitised dependency inventory you can archive as audit evidence, hand to a client or a legal review, or point any scanner at — Snyk via --snyk being one of them.

[!IMPORTANT] --offline reads the cache, it doesn't replace it. On a cold cache there is nothing to match against, so an offline first run legitimately reports 0 CVE / 0 EOL / 0 outdated; that's an empty cache, not a clean project. Warm it once (a normal online run on any project, or --import-cache), then --offline returns the full result set with zero network calls. Air-gapped machines get their cache via --export-cache / --import-cache.

A single self-contained binary (no Node), from-source install and shell completion are in → docs/USAGE.md.

What it finds

The report is organised into root chapters (each grouping related sub-chapters):

The HTML report opens in any browser, contains every detail (CVSS vectors, references, full descriptions, CPE configurations, via-paths for transitives) and ships a Word-compatible .doc twin. Every match carries a composite priority (KEV-exploited > EPSS likelihood > CVSS severity), and the run can additionally emit a CycloneDX 1.6 SBOM (--report-sbom, vulnerabilities inline) and a CSAF 2.0 VEX (--report-csaf) for downstream tooling.

Coverage, honestly: the pairs Snyk reports and fad-checker doesn't

No tool finds everything. fad-checker leads at 87% of a 908-pair union, and 131 pairs came back from Snyk and not from it. Adjudicated one by one against OSV, none is a recall bug:

Two thirds contradict the public record, so reporting them would mean shipping false positives. CVE-2023-6481 is the clean example: claimed on [email protected], it binds logback-core at [1.2.12, 1.2.13) — wrong artifact, and a version published before the flaw existed.

Scope. All 131 are Snyk's: OSV-Scanner, Trivy and Grype+Syft each contributed 0 findings no one else had. And all are on the Maven target — outside Maven the graph is in the lockfile, every scanner reads the same input, and the benchmark measures identical finding sets on npm, RubyGems and Composer.

Which is why --snyk exists. fad-checker takes snyk test output as an input and merges it, so you get the union rather than picking a side. A coverage choice, not a correction.

Method, caveats and the per-pair verdicts → docs/BENCHMARK.md; reproduce with scripts/adjudicate-gap.js.

Air-gapped audits

Zero-data-sent guarantee. Under --offline, fad-checker makes no network calls whatsoever; it reads only the warmed ~/.fad-checker/ caches and never transmits a dependency, path or finding off the machine. It is regression-tested (test/offline-guarantee.test.js, a tripwire fetcher that throws if touched) and auditor-reproducible: unshare -rn node fad-checker.js -s ./proj --offline … runs it in a namespace with no network interface and yields byte-identical findings. Unlike the mainstream OSS scanners, fad also resolves the Maven transitive graph offline; so on an air-gapped multi-module project it finds the transitive CVEs they can't.

When the audited system is offline / confidential (typical of a regulated or air-gapped audit) it can't reach OSV / NVD / Maven Central / npm. Split the work across machines while keeping zero environment information off the secure enclave: an anonymized descriptor carries only public package coordinates; no filesystem paths, no registry URLs, no hostnames/usernames; and the detailed report is produced back on the offline machine.

The transfer relies on a property of fad-checker's caches: they are keyed by coordinate or vuln id, never by path, so they are machine-independent. The online step just warms the caches; the offline step replays the scan and gets cache hits.

What the descriptor (fad-deps/1) contains vs. drops:

The online phase report is itself path-free; vendored-JavaScript (retire.js) findings are produced offline in phase 3, since retire needs the actual .js files; its signature DB is warmed online (phase 2) and carried by --export-cache. Full offline/cache control → docs/USAGE.md.

Docs

• docs/USAGE.md; every flag and workflow: offline/cache control, private registries, config files, recipes, safety rails.
• docs/ARCHITECTURE.md; internals: codecs, collection, matching, report pipeline.
• docs/COMPARISON.md; vs OSV-Scanner / Trivy / Grype / OWASP DC / Snyk, and how it stays build-free.
• docs/BENCHMARK.md — reproducible air-gapped recall benchmark vs OSV-Scanner on a public 105-module project.
• docs/DATA-SOURCES.md; the public datasets fad-checker uses + their licenses.
• docs/SPEC-audit-pro.md; the audit-grade features (provenance, differential audit, methodology/integrity) and why each was built that way.
• CHANGELOG.md · CLAUDE.md; release history · code-level orientation for contributors.

Contributing

The most useful contribution to a young scanner is telling it where it's wrong: run it on a real project and file a false positive / false negative report with the coordinate and the manifest snippet that produced it. Dev setup, ground rules and the codec extension point → CONTRIBUTING.md. Vulnerabilities in fad-checker itself → SECURITY.md (please report privately).

On AI assistance: this codebase is written with heavy use of Claude Code; CLAUDE.md in the repo root is exactly what it looks like. The bar it's held to is the one you can check yourself: 847 tests (npm test), the zero-network guarantee enforced by a tripwire test and reproducible under unshare -rn, and coverage numbers measured against a Snyk baseline rather than asserted. fad-checker itself uses no LLM at runtime; findings come from public vulnerability databases and deterministic parsers, and no report text is generated. Full statement, including where review actually caught a bad finding → AI_POLICY.md. Where the code doesn't meet that bar, that's a bug report I want.

License

MIT; see LICENSE.