Security News
vlt 1.5.0 Adds Agent Skills Management
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.
By Sarah Gooding - Oct 21, 2026
New:Introducing Socket Scanning for VS Code Marketplace Extensions.Learn more →
@ambolt/cra
Advanced tools
@ambolt/cra
Command-line checks for the EU Cyber Resilience Act: SBOM minimum-element check with optional OSV lookup, security.txt and vulnerability disclosure policy generators. No dependencies.
@ambolt/cra
Command-line helpers for the EU Cyber Resilience Act (Regulation (EU) 2024/2847). No dependencies, Node 18+. Information only, not legal advice. Web versions of the same checks: https://ambolt.dev/cra
# Check an SBOM (CycloneDX or SPDX JSON) against the minimum elements
npx @ambolt/cra sbom bom.json
# Also look up known vulnerabilities (sends package URLs to api.osv.dev)
npx @ambolt/cra sbom bom.json --osv
# In CI: fail when fewer than 8 checks pass, or when a component has a known vulnerability
npx @ambolt/cra sbom bom.json --osv --min 8 --fail-on-vulns
# Licence overview, copyleft risks for your own licence, and a THIRD-PARTY-NOTICES file
npx @ambolt/cra licences bom.json --project proprietary --out THIRD-PARTY-NOTICES.md
# What a public GitHub repository already shows: security policy and contact, SBOM export, releases
npx @ambolt/cra repo owner/name
# security.txt (RFC 9116) and a vulnerability disclosure policy draft
npx @ambolt/cra security-txt --contact security@example.com --out .well-known/security.txt
npx @ambolt/cra policy --product "My App" --org "My Company" --contact security@example.com --out SECURITY-POLICY.md
The SBOM is read locally. Without --osv nothing leaves your machine. Exit codes: 0 ok, 1 below --min or bad input, 2 vulnerabilities found with --fail-on-vulns or a high licence risk with --fail-on-risk, 3 OSV or GitHub unavailable.
The checks follow the NTIA minimum elements (supplier, name, version, unique identifier, relationships, author, timestamp) and the Regulation's wording that the SBOM is machine-readable and covers at least the top-level dependencies (Annex I, Part II). Article references are to the Regulation; check them against the Official Journal.
MIT licence.
FAQs
Command-line checks for the EU Cyber Resilience Act: SBOM minimum-element check with optional OSV lookup, security.txt and vulnerability disclosure policy generators. No dependencies.
The npm package @ambolt/cra receives a total of 11 weekly downloads. As such, @ambolt/cra popularity was classified as not popular.
We found that @ambolt/cra demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Package last updated on 05 Oct 2026
Related posts
Security News
Rust 1.100 Will Add Dependency Cooldowns to Cargo
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.
By Sarah Gooding - Oct 20, 2026
Security News
Deno Goes the Way of the Dinosaur
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.
By Sarah Gooding - Oct 16, 2026