@ambolt/cra
Advanced tools
Command-line checks for the EU Cyber Resilience Act: SBOM minimum-element check with optional OSV lookup, security.txt and vulnerability disclosure policy generators. No dependencies.
Command-line helpers for the EU Cyber Resilience Act (Regulation (EU) 2024/2847). No dependencies, Node 18+. Information only, not legal advice. Web versions of the same checks: https://ambolt.dev/cra
# Check an SBOM (CycloneDX or SPDX JSON) against the minimum elements
npx @ambolt/cra sbom bom.json
# Also look up known vulnerabilities (sends package URLs to api.osv.dev)
npx @ambolt/cra sbom bom.json --osv
# In CI: fail when fewer than 8 checks pass, or when a component has a known vulnerability
npx @ambolt/cra sbom bom.json --osv --min 8 --fail-on-vulns
# Licence overview, copyleft risks for your own licence, and a THIRD-PARTY-NOTICES file
npx @ambolt/cra licences bom.json --project proprietary --out THIRD-PARTY-NOTICES.md
# What a public GitHub repository already shows: security policy and contact, SBOM export, releases
npx @ambolt/cra repo owner/name
# security.txt (RFC 9116) and a vulnerability disclosure policy draft
npx @ambolt/cra security-txt --contact security@example.com --out .well-known/security.txt
npx @ambolt/cra policy --product "My App" --org "My Company" --contact security@example.com --out SECURITY-POLICY.md
The SBOM is read locally. Without --osv nothing leaves your machine. Exit codes: 0 ok, 1 below --min or bad input, 2 vulnerabilities found with --fail-on-vulns or a high licence risk with --fail-on-risk, 3 OSV or GitHub unavailable.
The checks follow the NTIA minimum elements (supplier, name, version, unique identifier, relationships, author, timestamp) and the Regulation's wording that the SBOM is machine-readable and covers at least the top-level dependencies (Annex I, Part II). Article references are to the Regulation; check them against the Official Journal.
MIT licence.
FAQs
Command-line checks for the EU Cyber Resilience Act: SBOM minimum-element check with optional OSV lookup, security.txt and vulnerability disclosure policy generators. No dependencies.
The npm package @ambolt/cra receives a total of 11 weekly downloads. As such, @ambolt/cra popularity was classified as not popular.
We found that @ambolt/cra demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.
Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.