9pings/fad-checkerBuildless dependency auditor that scans 10 ecosystems offline, reporting CVEs prioritized by CISA KEV and EPSS, EOL packages, licenses, committed keys, and binaries with SBOM and SARIF exports.
VigieVuln is a polyglot dependency auditor built for professional code audits.
It scans dependencies and 9 CMS/frameworks in one pass without build tools, supports air-gapped workflows, detects private packages, binaries and certificates, and produces HTML, JSON and other reports.
Terminal demo recorded with VigieVuln 1.2.1.
mvn/gradle/npm/pip/dotnet/go, no node_modules/ → how--offline → Benchmark · Air-gapped--set-proxy-cache vigievuln → hosted proxyvigievuln watch ./project --name 'My Project' — one free project with up to 100 distinct direct dependency coordinates → monitoring guidevigievuln serve-cache + --proxy-cache → cache usage--typosquat).SHA256SUMS;--baseline) and CI can gate on new findings only.--lang fr)--fail-on, triage with --ignore/--vex.📖 Usage & all flags · Architecture · Comparison vs other tools · Data sources
npm install -g vigievuln
vigievuln scan ./code # → ./vigievuln-report/cve-report.html
A free NVD API key (instant) gives 10× faster enrichment: vigievuln --set-nvd-key YOUR_KEY. A few common runs; full list via vigievuln --help or docs/USAGE.md
Monitor your project's direct dependencies for new high, critical or known exploited vulnerabilities. Create and verify a Vigie Vuln account first.
vigievuln login # sign in and accept the terms
vigievuln watch ./project --export deps.json # optional: review the inventory locally
vigievuln watch ./project --name 'My Project' # upload or update the project
vigievuln project status # check the monitoring status
Review the inventory before sharing, enable alerts in your account and upload again when dependencies change. The free tier covers one project, 100 direct coordinates and a 0.5 MB descriptor; each upload renews monitoring for one month. Monitoring guide.
Use Vigie Vuln DB as a European-hosted source for scans, including reviewed VigieVuln advisories for Maven and npm.
vigievuln login # sign in and select the official proxy if none is configured
vigievuln scan ./code # scan using the saved proxy and key
vigievuln setup --mode direct --sources all # switch back to direct sources
The proxy receives package coordinates and CVE identifiers, not source code. Cached advisories remain usable offline; partial version evidence leaves other versions unknown. Proxy guide.
These are standalone reports from real source scans, generated on 2026-11-04 with VigieVuln 1.2.1. Dubbo uses the hosted proxy; the CMS sample uses its local cache offline and focuses on PHP dependencies. Missing Wordfence/Drupal advisory and WordPress checksum inputs are explicitly marked incomplete. Sample scope, sources and reproduction commands.