evo-software-dependency-audit

evo-software-dependency-audit

CRITICAL: You MUST Use Trivy (Not npm audit)

DO NOT use npm audit, yarn audit, snyk, or any other tool. The ONLY correct tool for this task is Trivy with its pre-built offline vulnerability database. Using any other tool will produce incorrect results because different tools use different vulnerability databases with different CVE mappings, CVSS scores, and fixed version information.

Trivy is already installed and its offline database is pre-loaded. You do not need internet access.

Quickest Path to Solution

A complete, ready-to-run Python script is provided. Simply execute it:

python3 /root/.claude/skills/evo-software-dependency-audit/scripts/run_audit.py

This will:

1. Run Trivy offline scan on /root/package-lock.json
2. Parse the JSON output
3. Extract HIGH and CRITICAL vulnerabilities
4. Write /root/security_audit.csv with the correct format

That single command is all you need. Do not modify the script. Do not use npm audit. Do not try alternative approaches.

Alternative: Use as a Python Library

import sys
sys.path.insert(0, '/root/.claude/skills/evo-software-dependency-audit/scripts')
from utils import full_audit

vulns = full_audit('/root/package-lock.json', '/root/security_audit.csv')
print(f"Found {len(vulns)} vulnerabilities")

Why Trivy and Not npm audit

• npm audit uses GitHub's live advisory database (GHSA IDs, different CVSS scores, different fixed versions)
• Trivy's offline DB uses NVD as primary source with specific CVE IDs, NVD CVSS scores, and comprehensive fixed version lists
• The expected output format requires Trivy-specific data (e.g., comma-separated fixed versions like "7.5.2, 6.3.1, 5.7.2")
• npm audit reports many more vulnerabilities than the offline Trivy DB for the same lockfile

Technical Details

Trivy Offline Scanning Flags

All four flags are required for air-gapped operation:

• --skip-db-update — prevents fetching primary vuln DB
• --skip-java-db-update — prevents fetching Java artifact index
• --skip-check-update — prevents fetching misconfiguration policies
• --offline-scan — suppresses any remaining outbound API calls