Inventory
Find supported manifests and lockfiles without installing dependencies or running lifecycle scripts.
← CyberHawk vulnerability research
// PICKBITS DEPENDENCY AUDIT
Turn a folder of lockfiles into a reviewable vulnerability report.
The same small workflow we run on our own projects: OSV-Scanner for known-vulnerability matching, SQLite for history, a standalone HTML report, and an action queue that still needs human approval.
MIT licensed · report-only · runs locally · no source-code upload
THE COMPLETE RUN
From folder to local report.
The video uses redacted aggregates from one Windows portfolio scan. Repository names, detailed paths, and canary markers are not shown.
WHAT THE PACKAGE DOES
Five steps, from inventory to verified fix.
Match
Use OSV’s structured advisory data to identify affected package versions and known fixed releases.
Record
Persist runs, findings, and npm lockfile policy decisions in a local SQLite database.
Review
Render a standalone HTML report and export remediation requests as structured data, not runnable commands.
Verify
Rescan after an approved change and retain the finding until repeated complete scans show it absent.
CASE STUDY · JULY 22, 2026
One local Windows portfolio, measured two ways.
The vulnerability scan and npm admission audit use different denominators. Finding occurrences are not unique CVEs and do not prove reachability or exploitability.
- Dependency inputs
- 78
- Package occurrences
- 27,474
- Finding occurrences
- 2,530
Each finding is one advisory attached to one package occurrence. The same advisory can appear in more than one project or dependency source.
- Lockfile records
- 28,182
- Review
- 2,123
- Quarantine
- 243
ALLOW_LOCKED means the exact version had integrity evidence and an approved registry. Publisher provenance was not verified.
Report-only, point-in-time evidence. No packages were installed, no project files were edited, and no repository was pushed by the audit.
SCOPE
A small local layer, not a replacement for an enterprise program.
It is most useful for code that lives across local folders, prototypes, and multiple repositories. Dependabot remains a strong GitHub-native pull-request workflow; broader platforms cover endpoint, cloud, compliance, and enterprise response programs.
What this prototype does not claim
- It is not antivirus or malware detection.
- A checksum does not establish publisher trust.
- A finding does not prove vulnerable code is reachable.
- Automatic patch execution is not enabled.
- The defensive canary is a controlled experiment, not an attack claim.
THE PACKAGE
The scanner and report work without an AI agent.
The core requires Node.js, OSV-Scanner, and local files. Claude Code, cron, Windows Task Scheduler, and GitHub Actions are optional ways to schedule or review the same workflow.
# core workflow — agent optional
osv-scanner scan source -r --all-packages --format=json --output=reports\osv-result.json C:\path\to\project
node scripts\trust-audit.mjs --scan reports\osv-result.json --target C:\path\to\project --db reports\audit-state.db --output reports\audit-run.json
node scripts\generate-report.mjs --scan reports\osv-result.json --target C:\path\to\project --output reports\audit-report.html