safedep/vet

[!NOTE] vet supports special mode for Agent Skills. Run vet scan --agent-skill <owner/repo> to scan an Agent Skill hosted in a GitHub repository.

Why vet?

70-90% of modern software is open source code — how do you know it's safe?

Traditional SCA tools drown you in CVE noise. vet takes a different approach:

• Shadow AI discovery — Discover AI tool usage signals across various tools and configurations
• Catch malware before it ships — Zero-day detection through static and dynamic behavioral analysis (requires SafeDep Cloud access)
• Cut through vulnerability noise — Analyzes actual code usage to surface only the risks that matter
• Enforce policy as code — Express security, license, and quality requirements as CEL expressions
• CI/CD integration — Zero-config security guardrails in CI/CD

Free for open source. Hosted SaaS available at SafeDep.

Quick Start

Install in seconds:

# macOS & Linux
brew install safedep/tap/vet

# Using npm
npm install -g @safedep/vet

or download a pre-built binary

Get started immediately:

# Scan for malware in your dependencies
vet scan -D . --malware-query

# Fail CI on critical vulnerabilities
vet scan -D . --filter 'vulns.critical.exists(p, true)' --filter-fail

Architecture

vet follows a pipeline architecture: readers ingest package manifests from diverse sources (directories, repositories, container images, SBOMs), enrichers augment each package with vulnerability, malware, and scorecard data from SafeDep Cloud, the CEL policy engine evaluates security policies against enriched data, and reporters produce actionable output in formats like SARIF, JSON, and Markdown.

graph TB
    subgraph "OSS Ecosystem"
        R1[npm Registry]
        R2[PyPI Registry]
        R3[Maven Central]
        R4[Other Registries]
    end

    subgraph "SafeDep Cloud"
        M[Continuous Monitoring]
        A[Real-time Code Analysis<br/>Malware Detection]
        T[Threat Intelligence DB<br/>Vulnerabilities • Malware • Scorecard]
    end

    subgraph "vet CLI"
        S[Source Repository<br/>Scanner]
        P[CEL Policy Engine]
        O[Reports & Actions<br/>SARIF/JSON/CSV]
    end

    R1 -->|New Packages| M
    R2 -->|New Packages| M
    R3 -->|New Packages| M
    R4 -->|New Packages| M
    M -->|Behavioral Analysis| A
    A -->|Malware Signals| T

    S -->|Query Package Info| T
    T -->|Security Intelligence| S
    S -->|Analysis Results| P
    P -->|Policy Decisions| O

    style M fill:#7CB9E8,stroke:#5A8DB8,color:#1a1a1a
    style A fill:#E8A87C,stroke:#B88A5A,color:#1a1a1a
    style T fill:#7CB9E8,stroke:#5A8DB8,color:#1a1a1a
    style S fill:#90C695,stroke:#6B9870,color:#1a1a1a
    style P fill:#E8C47C,stroke:#B89B5A,color:#1a1a1a
    style O fill:#B8A3D4,stroke:#9478AA,color:#1a1a1a

Key Features

Malicious Package Detection

Real-time protection against malicious packages powered by SafeDep Cloud. Free for open source projects. Detects zero-day malware through active code analysis.

Vulnerability Analysis

Unlike dependency scanners that flood you with noise, vet analyzes your actual code usage to prioritize real risks. See dependency usage evidence for details.

Policy as Code

Define security policies using CEL expressions to enforce context specific requirements:

# Block packages with critical CVEs
vet scan --filter 'vulns.critical.exists(p, true)' --filter-fail

# Enforce license compliance
vet scan --filter 'licenses.contains_license("GPL-3.0")' --filter-fail

# Require minimum OpenSSF Scorecard scores
vet scan --filter 'scorecard.scores.Maintained < 5' --filter-fail

Multi-Ecosystem Support

Package managers: npm, PyPI, Maven, Go, Ruby, Rust, PHP Container images: Docker, OCI SBOM formats: CycloneDX, SPDX Source repositories: GitHub, GitLab

Malicious Package Detection

Real-time protection against malicious packages by querying SafeDep's threat intelligence database, continuously populated through static and dynamic behavioral analysis.

Quick Setup

# Query known malicious packages (no API key needed)
vet scan -D . --malware-query

[!NOTE] The --malware flag is deprecated. Active (on-demand) scanning has been retired in favour of querying SafeDep's threat intelligence database. --malware now behaves identically to --malware-query and is retained for backward compatibility.

Example detections:

• MAL-2025-3541: express-cookie-parser
• MAL-2025-4339: eslint-config-airbnb-compat
• MAL-2025-4029: ts-runtime-compat-check

Key security features:

• Real-time lookups against SafeDep's known malicious packages database
• Behavioral analysis using static and dynamic analysis (performed continuously in SafeDep Cloud)
• Human-in-the-loop triaging for high-impact findings
• Public analysis log for transparency

Advanced Usage

# Specialized scans
vet scan --vsx --malware-query                  # VS Code extensions
vet scan -D .github/workflows --malware-query   # GitHub Actions
vet scan --image nats:2.10 --malware-query      # Container images

[!NOTE] The vet inspect malware command (on-demand analysis of a single package) is deprecated and will be removed in a future release. Use vet scan --malware-query to check packages against SafeDep's known malicious packages database.

Production Ready Integrations

GitHub Actions

Zero-config security guardrails in CI/CD:

- uses: safedep/vet-action@v1
  with:
    policy: ".github/vet/policy.yml"

See vet-action documentation.

GitLab CI

Enterprise scanning with vet CI Component:

include:
  - component: gitlab.com/safedep/ci-components/vet/scan@main

Container Integration

Run vet anywhere using our container image:

docker run --rm -v $(pwd):/app ghcr.io/safedep/vet:latest scan -D /app --malware-query

Installation

Homebrew (Recommended)

brew install safedep/tap/vet

npm

npm install @safedep/vet

Direct Download

See releases for pre-built binaries.

Go Install

go install github.com/safedep/vet@latest

Container Image

# Quick test
docker run --rm ghcr.io/safedep/vet:latest version

# Scan local directory
docker run --rm -v $(pwd):/workspace ghcr.io/safedep/vet:latest scan -D /workspace

Verify Installation

vet version
# Should display version and build information

Advanced Features

Learn more in our comprehensive documentation:

• AI Usage Discovery - Discover AI tool usage signals across various tools and configurations
• AI Agent Mode - Run vet as an AI agent
• MCP Server - Run vet as an MCP server for AI-assisted code analysis
• Reporting - SARIF, JSON, CSV, HTML, Markdown formats
• SBOM Support - CycloneDX, SPDX import/export
• Query Mode - Scan once, analyze multiple times
• GitHub Integration - Repository and organization scanning
• GitHub Actions Pinning - Pin GitHub Actions to commit SHAs to prevent supply chain attacks

Privacy

vet collects anonymous usage telemetry to improve the product. Your code and package information is never transmitted.

# Disable telemetry (optional)
export VET_DISABLE_TELEMETRY=true

Community & Support

Get Help & Share Ideas

• Interactive Tutorial - Learn vet hands-on
• Complete Documentation - Comprehensive guides
• Discord Community - Real-time support
• Issue Tracker - Bug reports & feature requests
• Contributing Guide - Join the development

Star History

Built With Open Source

vet stands on the shoulders of giants:

OSV • OpenSSF Scorecard • SLSA • OSV-SCALIBR • Syft

Contributors

Thank you to all contributors ❤️

---

Secure your supply chain today. Star the repo and get started!

Created with love by SafeDep and the open source community