pkgaudit

Multi-lockfile CVE scanner — Cargo / npm / Python / Go via OSV.dev with DORA Art. 28 mapping

v1.0.0

NixOS x86_64

Quick start

Install via jcli (recommended)

jcli install pkgaudit

If you don't have jcli yet, install it first with curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash.

Install directly

curl -fsSL https://cli.johlem.net/install.sh | bash -s -- pkgaudit

Ed25519 signature verification is mandatory by default; set ALLOW_UNVERIFIED=1 to explicitly opt out (not recommended).

Run it

pkgaudit --help                # subcommand catalogue + flags
pkgaudit --full                # extended help across every subcommand
pkgaudit --about               # machine-readable attribution (JSON)
pkgaudit --version             # version string

What it does

pkgaudit walks one or more paths, parses every supported lockfile (Cargo.lock v3, package-lock.json v2/v3 + v1 fallback, yarn.lock, pnpm-lock.yaml, npm-shrinkwrap.json, requirements.txt strict pins, Pipfile.lock, poetry.lock, go.sum) and — when --online is set — queries the OSV.dev REST API for known vulnerabilities. Five subcommands: scan (auto-detect every lockfile under the path), cargo, npm, python, go. Output: jfind/v1 `vulnerability` per OSV hit (with CVE id, fixed versions, OSV.dev URL, severity from CVSS or database_specific) plus `asset-inventory` per clean package. Pre-fills DORA Art. 9 + DORA Art. 28 (ICT third-party risk — the central control for vulnerable third-party libraries) + NIS2 Art. 21(2)(d) + ISO/IEC 27001:2022 A.5.21 controls; MITRE T1195.001 (Supply Chain Compromise — Software Dependencies). Default is offline (inventory only) for determinism; --online opt-in. A failed OSV query is logged but does not abort the scan. Suite app: blueteam. 15 unit + 13 integration tests; zero warnings.

Authorisation and warranty: use only in environments where you have explicit written authorisation. This tool is provided as-is with no warranty. Report vulnerabilities privately at security@johlem.net.

Compliance crosswalk

This table lists controls where pkgaudit's output may form part of the evidence set presented to an assessor. It does not claim pkgaudit alone satisfies any framework — every control still requires assessor judgment and typically evidence from other sources.

Schema: compliance-crosswalk/v1 · Machine-readable: tools/pkgaudit/compliance.json

ISO27001 — ISO/IEC 27001:2022

Ref	Name	How	Coverage
`A.8.8`	Management of technical vulnerabilities	OSV.dev CVE lookup against lockfiles produces a vulnerability inventory per project.	evidences

NIS2 — NIS2 Directive (Dir. 2022/2555)

Ref	Name	How	Coverage
`Art. 21 §2(e)`	Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure	Automated lockfile scanning against a public advisory DB.	supports

DORA — Digital Operational Resilience Act

Ref	Name	How	Coverage
`Art. 9`	Protection and prevention	Continuous vulnerability inventory supports the protection control.	supports

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.

manifest.json — pinned SHA-256 + .sig URL + SBOM URL per platform
johlem-release.pub — Ed25519 public key used by signify -V (fingerprint: 4532510f…6748, pinned in jcli verify)
CHANGELOG.md — semver-tagged release notes
Security contact: security@johlem.net