OPEN SOURCE · NO API KEY · npm · PyPI · Go · Rust · Maven · Ruby · PHP · NuGet · SBOM · monorepos

Most SCA alerts are noise.
vulntriage tells you which ones aren’t.

Fuse OSV advisories, FIRST EPSS, CISA KEV, import reachability, and dependency role into a transparent triage decision for every finding — so your team stops burning sprints on CVEs that never touch production.

npm install -g vulntriage GitHub Docs

$ npx vulntriage .

vulntriage v0.7.8
4 packages · 8 findings · 7.5s

 FIX SOON 6    NOISE 2 

FIX_SOON     66   lodash@4.17.20
             CVE-2021-23337 · EPSS 22.41% · imported · direct/production
             Upgrade lodash to 4.18.0 in the next sprint.

FIX_SOON     64   minimist@0.2.1
             CVE-2021-44906 · EPSS 4.58% · imported · direct/production
             Upgrade minimist to 1.2.6 in the next sprint.

LIKELY_NOISE  0   debug@2.6.8
             CVE-2017-20165 · HIGH CVSS · not_imported · development
             Likely noise: debug does not appear imported.

// Real scan: expressjs/multer → 8 findings, 100% classified as noise

Five free signals. One decision.

01 · OSV

Advisory match

Is this package version known-vulnerable in the OSV database?

02 · EPSS

Exploit probability

How likely is exploitation in the next 30 days (FIRST.org)?

03 · KEV

Active exploitation

Is CISA listing this as already exploited in the wild?

04 · Imports

Reachability

Do your sources actually import/require the package?

05 · Role

Dependency graph

Direct vs transitive? Production vs development?

OUT

Transparent score

Every point is explained. No black-box ranking.

What the decisions mean

Decision	When	Action
FIX NOW	High risk, reachable, or CISA KEV on a production path	Patch before merge / today
FIX SOON	Material risk with a clear remediation path	Next sprint
MONITOR	Low urgency; watch EPSS / usage drift	Optional ticket
LIKELY NOISE	Unimported, dev-only, low EPSS, or similar	Document or drop unused dep

Install in 10 seconds

# one-shot

npx vulntriage .

# or install globally

npm install -g vulntriage

vulntriage --format sarif -o report.sarif --fail-on fix_now

Works offline against fixtures for tests. Online mode needs only public OSV / EPSS / CISA endpoints — no accounts, no tokens, no vendor lock-in.

Why this exists

npm audit is broken by design for many real codebases: it equates “package present in the lockfile” with “you must act.” Commercial SCA tools sell reachability analysis. vulntriage makes the prioritization layer open, free, and explainable — so security and engineering share the same evidence, not a score nobody trusts.

impactest selects which tests to run from a git diff (JS/TS, Python, Go) — npm i -g impactest.

Family of tools

vulntriage — which CVEs matter
impactest — which tests to run
gha-step — run CI shell steps locally
Blog: sybilgambleyyu.github.io