vulkro-sf sca
Checks the project's managed packages and the JavaScript inside static resources for known vulnerabilities, end-of-life versions and unpinned dependencies.
vulkro-sf sca .
vulkro-sf sca . --format json > sca.json
It reads the package dependencies from sfdx-project.json (packageDirectories[].dependencies) and *.installedPackage-meta.xml, then matches them against an offline managed-package advisory feed and an end-of-life table bundled in the binary. Refresh that data with vulkro-sf update. The command never contacts your org or the network.
| Finding | Meaning |
|---|---|
SF-SCA-001 | Managed package version matches a CVE advisory. |
SF-SCA-002 | End-of-life or unsupported managed package. |
SF-SCA-003 | Vulnerable JavaScript in a static resource. |
SF-SCA-004 | Managed-package dependency with no pinned version. |
| Flag | What it does |
|---|---|
[PATH] | SFDX project or retrieved metadata. Default .. |
--format <table|json> | Output format. Default table. |
Exit codes
| Code | Meaning |
|---|---|
0 | No SCA findings. |
1 | At least one SCA finding. |
2 | Error (unscannable path, IO failure, bad arguments). |