vulkro respond

Answers "is this package or advisory in my project?" in under a second, for the moment a new advisory drops.

vulkro respond --package event-stream@3.3.6 .
vulkro respond --package requests==2.31.0 .
vulkro respond --advisory SUP-COMPROMISE-001 .

It reads the lockfiles (package-lock.json, npm-shrinkwrap.json, poetry.lock, Pipfile.lock, Cargo.lock, go.sum) and the imports in JavaScript, TypeScript, Python, Go and Rust files, then lists every place the package appears, direct or transitive. It does not run a full scan and does not query any advisory service.

Flags

Pass exactly one of --package or --advisory.

Flag	Description
--package <PKG@VER>	name@version (npm, Cargo, scoped npm) or name==version (PyPI).
--advisory <ID>	SUP-COMPROMISE-001 to 005, or an incident ID such as INCIDENT-2018-event-stream. CVE IDs are not supported: use --package, or run vulkro scan.
-f, --format <FORMAT>	table (default), json, sarif, gh-pr, junit, csv.
--no-cache	Skip the cached index and rebuild it.
--ai	Add an advisory local-model note on each match. Never changes the result or the exit code.

The index is cached under ~/.vulkro/cache/ and rebuilt when any lockfile changes.

Exit codes

Code	Meaning
0	Not found: you are not exposed.
1	Found in at least one place.
2	Bad argument, IO failure or unsupported advisory ID.

See also: SUP-COMPROMISE rules, vulkro match-cve.