cve-audit

Exact CVE Audit

Audit exact npm versions from an immutable package-lock.json against OSV. Runx owns every network request, response bound, retry, host admission, and receipt. Package code owns only lockfile inventory and OSV result semantics.

The audit is read-only. It does not install dependencies, execute target code, repair packages, publish advisories, or treat missing OSV data as proof of safety.

When to use it

Use cve-audit when a reviewer needs reproducible evidence for the advisories affecting exact npm versions in a public immutable lockfile. It is appropriate for dependency review, release triage, and the evidence stage before vuln-triage. Exact-version matching matters: package-name or loose-range scans can turn possible exposure into false findings.

Do not use it for mutable branch URLs, private repositories without a declared reader, non-npm ecosystems, exploit development, or coverage claims broader than the selected dependency scope.

Inputs

• target_name: human-readable project name.
• target_repo: public https://github.com/... repository URL.
• target_commit: full 40-character Git commit.
• lockfile_url: raw.githubusercontent.com package-lock URL containing that commit in its path.
• dependency_scope: direct-production by default, or all-installed.

Private repositories, credentials, mutable branch URLs, abbreviated commits, and non-npm lockfiles are outside this runner.

Execution contract

1. Validate the immutable GitHub target before any network call.
2. Read the pinned lockfile with native http.read, retaining its transport digest and refusing truncation.
3. Extract exact installed versions from package-lock versions 2 or 3. The inventory is capped at 10,000 entries.
4. Query OSV in batches of 500 with native http.query. This is a POST-only, read-only query boundary; it is not a mutation lane.
5. Refuse the audit if any OSV query result carries a page token. A partial provider result must never be reported as complete.
6. Read each returned advisory with native http.read, validate advisory identity, and exclude withdrawn advisories. The verified advisory set is capped at 50; a larger set stops instead of being truncated.
7. Assemble the audit, report, and evidence from the exact inventory and full advisory records.
8. Repeat the OSV query and advisory reads in separate graph steps. Compare dependency path, exact version, advisory id, and withdrawal state. Finalize only when the two complete sets match.