Dependency Safety and Compliance for .NET and npm Projects

DepSafe is a comprehensive dependency analysis tool that helps development teams assess package health, ensure EU Cyber Resilience Act (CRA) compliance, and manage supply chain security for both .NET (NuGet) and JavaScript (npm) projects.

This is a personal hobby project built and maintained by a single developer in my spare time, with the goal of giving something useful back to the community. It is provided as-is, with no warranties or guarantees of any kind. There is no company, organization, or dedicated team behind it -- just one person who cares about dependency safety and open source.

Please use it at your own risk. While I do my best to keep things working and accurate, I cannot promise timely fixes, support, or continued development. If you find it helpful, that's wonderful -- but please do not rely on it as your sole source of truth for compliance or security decisions.

• Features
• Installation
• Quick Start
• Commands
  • cra-report
  • analyze
  • check
  • sbom
  • vex
  • licenses
  • typosquat
  • badge
• Configuration
• CRA Compliance Report
• CRA Readiness Score
• Health Score Calculation
• License Compatibility
• Environment Variables
• CI/CD Integration
• MSBuild Integration
• License

• NuGet packages - Full support for .NET projects, solutions, and Directory.Build.props
• npm packages - Full support for package.json and package-lock.json
• Mixed projects - Analyze repositories containing both .NET and npm components

• 0-100 health score based on freshness, release cadence, download trends, repository activity, and vulnerabilities
• Abandonment prediction - Identifies packages at risk of being abandoned
• Version status tracking - Shows available updates with color-coded urgency indicators
• Peer dependency analysis - Lists peer dependencies with version requirements (npm)

• Article 10 - SBOM - Software Bill of Materials generation (SPDX 3.0 and CycloneDX)
• Article 10(4) - KEV Monitoring - CISA Known Exploited Vulnerabilities catalog integration
• Article 10(4) - EPSS Scoring - Exploit Prediction Scoring System for vulnerability prioritization
• Article 10(6) - Security Updates - Data-driven detection of archived and stale dependencies
• Article 10(9) - License Information - SPDX license identification and compatibility
• Article 10 - Deprecated Components - Identifies deprecated packages requiring replacement
• Article 10 - Cryptographic Compliance - Detects deprecated crypto algorithms and libraries
• Article 10 - Supply Chain Integrity - Typosquatting detection for dependency verification
• Article 11 - Vulnerability Handling - VEX document generation with OSV vulnerability data
• Article 11(4) - Remediation Timeliness - Tracks unpatched vulnerabilities with available fixes
• Article 11(5) - Security Policy - GitHub security policy detection
• Article 13(5) - Package Provenance - NuGet and npm registry signature verification
• Article 13(8) - Support Period - Detects unmaintained packages lacking ongoing support
• Article 14 - Incident Reporting - CSIRT notification detection for actively exploited vulnerabilities (24h/72h/14d deadlines)
• Annex I Part I(1) - Release Readiness - Verifies no known exploitable vulnerabilities at release
• Annex I Part I(10) - Attack Surface - Dependency tree depth and transitive ratio analysis
• Annex I Part II(1) - SBOM Completeness - BSI TR-03183-2 field validation
• Annex II - Documentation - Project documentation requirements (README, SECURITY.md, support period)
• CRA Readiness Score - Weighted compliance gauge (0-100) across all items

• OSV Vulnerability Database - Real-time vulnerability scanning (no API key required)
• CISA KEV Catalog - Actively exploited vulnerability detection
• EPSS Scoring - Exploit probability prediction for prioritization
• GitHub Advisory Database - Additional vulnerability context via GitHub API
• Version-aware filtering - Only reports vulnerabilities affecting your specific versions

• Interactive HTML reports - Dashboard with drill-down, filtering, dependency trees, and force-directed risk heatmap
• Art. 14 Reporting Obligations - Flags vulnerabilities requiring CSIRT notification with 24h/72h/14d deadlines
• Remediation Roadmap - Prioritized update plan ranked by CRA score improvement, KEV status, and EPSS probability, with per-tier upgrade risk assessment
• JSON export - Machine-readable format for automation
• License attribution files - Generate THIRD-PARTY-NOTICES in TXT, HTML, or Markdown
• shields.io badges - Embeddable status badges for your README

dotnet tool install -g DepSafe

dotnet new tool-manifest  # If you don't have a manifest yet
dotnet tool install DepSafe

depsafe --version

# Navigate to your project directory
cd /path/to/your/project

# Generate comprehensive CRA compliance report
depsafe cra-report

# Quick health analysis
depsafe analyze

# Check a single package
depsafe check Newtonsoft.Json

# Generate SBOM
depsafe sbom --output sbom.spdx.json

# Check license compatibility
depsafe licenses

Generates a comprehensive EU Cyber Resilience Act compliance report with interactive HTML dashboard.

depsafe cra-report [<path>] [options]

Arguments:

Options:

Exit Codes:

Examples:

# Basic report
depsafe cra-report

# Full analysis with transitive packages
depsafe cra-report --deep

# Generate report with SBOM and license file
depsafe cra-report --sbom spdx --licenses txt

# JSON output for automation
depsafe cra-report --format json --output compliance.json

# Analyze specific solution
depsafe cra-report ./src/MyApp.sln --deep

# Sign all generated artifacts
depsafe cra-report --sbom spdx --sign

# Sign with a specific key
depsafe cra-report --sign --sign-key ./keys/signing.pem

# Release gate with blocking/advisory classification
depsafe cra-report --release-gate

# Generate evidence pack with all compliance artifacts
depsafe cra-report --evidence-pack --sbom spdx --licenses txt

Performs health analysis on all direct dependencies with console output.

depsafe analyze [<path>] [options]

Options:

Examples:

# Analyze current project
depsafe analyze

# CI/CD - fail if health score drops below 60
depsafe analyze --fail-below 60

# Generate markdown report
depsafe analyze --format markdown > health-report.md

Check health of a specific NuGet or npm package.

depsafe check <package> [options]

Options:

Examples:

# Check latest version
depsafe check Newtonsoft.Json

# Check specific version
depsafe check Serilog --version 3.1.1

# JSON output
depsafe check react --format json

Generate SBOM in SPDX 3.0 or CycloneDX format.

depsafe sbom [<path>] [options]

Options:

Examples:

# SPDX format to stdout
depsafe sbom

# CycloneDX to file
depsafe sbom --format cyclonedx --output bom.json

# SPDX with full vulnerability data
depsafe sbom --output sbom.spdx.json

# Sign the SBOM
depsafe sbom --output sbom.spdx.json --sign

Generate OpenVEX document with vulnerability status for all dependencies.

depsafe vex [<path>] [options]

Options:

Examples:

# Output to console
depsafe vex

# Save to file
depsafe vex --output vulnerabilities.vex.json

# Sign the VEX document
depsafe vex --output vulnerabilities.vex.json --sign

DepSafe uses Sigil.Sign for detached artifact signing. When you pass --sign, each generated artifact gets a .sig.json envelope file alongside it containing a cryptographic signature.

Signing produces:

Prerequisites:

Install Sigil.Sign as a global tool:

dotnet tool install -g Sigil.Sign

Signing artifacts:

# Sign with default key
depsafe cra-report --sbom spdx --licenses txt --sign

# Sign with a specific key
depsafe cra-report --sign --sign-key ./keys/signing.pem

Verifying artifacts (consumer responsibility):

Verification is performed externally by the consumer using the sigil CLI:

# Basic verification
sigil verify cra-report.html.sig.json

# Verify with a trust bundle
sigil verify cra-report.html.sig.json --trust-bundle keys.pem

# Verify with DNS discovery
sigil verify cra-report.html.sig.json --discover example.com

Analyze dependency licenses for compatibility with your project license.

depsafe licenses [<path>] [options]

Options:

Examples:

# Check against MIT license
depsafe licenses

# Check against Apache-2.0
depsafe licenses --project-license Apache-2.0

# Include transitive dependencies
depsafe licenses --include-transitive

# JSON output
depsafe licenses --format json

Scan project dependencies for potential typosquatting attacks using edit distance analysis, separator substitution, scope confusion, and other detection heuristics.

depsafe typosquat [<path>] [options]

Options:

Examples:

# Scan current project
depsafe typosquat

# Offline mode (no network calls for package index)
depsafe typosquat --offline

# JSON output for automation
depsafe typosquat --format json

Generate shields.io badges for your README.

depsafe badge [<path>] [options]

Options:

Examples:

# Generate markdown badges
depsafe badge

# Different style
depsafe badge --style for-the-badge

# HTML format
depsafe badge --format html --output badges.html

Create a .cra-config.json file in your project root to customize CRA analysis:

{
  "licenseOverrides": {
    "SixLabors.ImageSharp": "Apache-2.0",
    "SomeInternalPackage": "MIT"
  },
  "excludePackages": [
    "MyCompany.Internal.Utils"
  ],
  "complianceNotes": {
    "OldLegacyPackage": "Approved for use until Q4 2025 migration"
  },
  "supportPeriodEnd": "2028-12",
  "securityContact": "security@example.com",
  "allowedLicenses": ["MIT", "Apache-2.0", "BSD-3-Clause"],
  "blockedLicenses": ["GPL-3.0-only"],
  "failOnDeprecatedPackages": true,
  "minHealthScore": 50,
  "failOnKev": true,
  "failOnEpssThreshold": 0.5,
  "failOnVulnerabilityCount": 0,
  "failOnCraReadinessBelow": 70,
  "failOnReportableVulnerabilities": true,
  "failOnUnpatchedDaysOver": 30,
  "failOnUnmaintainedPackages": false,
  "failOnSbomCompletenessBelow": 80,
  "failOnAttackSurfaceDepthOver": 10
}

Configuration Options:

The HTML report includes comprehensive compliance information:

• CRA Readiness Score gauge (0-100, weighted across all compliance items)
• Overall CRA compliance status with requirement count
• CRA compliance score gauge
• Health score gauge
• Package count breakdown (direct vs transitive)
• Vulnerability summary and version conflicts
• License status summary
• Recommended actions for non-compliant items

Each package displays:

• Health score (0-100) with status indicator
• CRA compliance score (0-100)
• License information
• Version status - Shows if update available with upgrade urgency
• Release information - Last release date, releases per year
• Repository stats - Stars, last commit (when GitHub token available)
• Vulnerabilities - CVE IDs with links to details
• Peer dependencies - For npm packages
• Dependencies - Clickable links to navigate dependency tree
• Recommendations - Actionable improvement suggestions

When actively exploited or high-probability vulnerabilities are detected:

• CSIRT notification deadlines — 24-hour early warning, 72-hour full notification, 14-day final report
• Detection criteria — CISA KEV catalog (confirmed exploitation) or EPSS probability >= 0.5
• Trigger badges — KEV, EPSS, or Both indicators per package
• Overdue tracking — Highlights deadlines that have already passed
• Shows a success card when no reportable vulnerabilities are found

Prioritized update plan for vulnerable dependencies:

• Priority ranking — KEV > EPSS >= 0.5 > Critical > High severity > CRA score lift
• Score Lift — Estimated CRA readiness score improvement per package update
• Effort indicator — Patch (low risk), Minor (new features), Major (breaking changes)
• Upgrade Risk Assessment — Composite risk score (0-100) per upgrade tier based on changelog analysis, semver signal, maintainer trust, and version time gap. Risk badges (Low/Medium/High/Critical) with hover tooltips showing risk factors
• Version recommendations — Current vs recommended version with CVE count
• Top 20 most impactful updates, sorted by priority
• Shows a success card when no remediation actions are needed

Interactive tree visualization showing:

• Full dependency hierarchy
• Health status per node
• Vulnerability indicators (red highlight for KEV)
• Expand/collapse navigation

Interactive force-directed graph visualization showing:

• Node size proportional to reverse dependency count (how many packages depend on it)
• Node color reflects health score (green/yellow/orange/red)
• Node border indicates vulnerability status (solid for CVE, dashed for KEV)
• Edges show dependency relationships
• Hover to highlight connected packages and view details
• Click to navigate to package details
• Drag nodes, zoom, toggle labels

• Embedded SBOM (SPDX 3.0 format)
• Embedded VEX document
• Export buttons for both formats

The CRA Readiness Score is a single weighted metric (0-100) that reflects overall compliance posture. Each compliance item is weighted by CRA importance:

Score calculation per item:

Each package receives a health score (0-100) based on weighted factors:

Separate from health score, focuses on regulatory requirements:

The licenses command detects potential license conflicts:

For best results, create a GitHub personal access token with public_repo scope:

1. Go to GitHub Settings → Developer settings → Personal access tokens
2. Generate a new token with public_repo scope
3. Set the environment variable:

Windows (PowerShell):

$env:GITHUB_TOKEN = "ghp_your_token_here"

Linux/macOS:

export GITHUB_TOKEN="ghp_your_token_here"

DepSafe supports config-driven CI/CD build gates via .cra-config.json. When thresholds are violated, DepSafe returns exit code 2 (distinct from exit code 1 for tool errors), making it easy to fail builds on policy violations.

{
  "failOnKev": true,
  "failOnVulnerabilityCount": 0,
  "failOnCraReadinessBelow": 70,
  "failOnReportableVulnerabilities": true,
  "failOnUnpatchedDaysOver": 30,
  "failOnUnmaintainedPackages": true,
  "failOnSbomCompletenessBelow": 80,
  "failOnAttackSurfaceDepthOver": 10
}

name: Dependency Health Check

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'  # Weekly on Monday

jobs:
  health-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Install DepSafe
        run: dotnet tool install -g DepSafe

      - name: Run Health Analysis
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: depsafe analyze --fail-below 60

      - name: CRA Compliance Gate
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          depsafe cra-report --deep --output cra-report.html
          # Exit code 2 = policy violation (from .cra-config.json thresholds)

      - name: Upload Report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cra-compliance-report
          path: cra-report.html

trigger:
  - main

pool:
  vmImage: 'ubuntu-latest'

steps:
  - task: UseDotNet@2
    inputs:
      version: '10.0.x'

  - script: dotnet tool install -g DepSafe
    displayName: 'Install DepSafe'

  - script: depsafe analyze --fail-below 60
    displayName: 'Check Dependency Health'
    env:
      GITHUB_TOKEN: $(GITHUB_TOKEN)

  - script: depsafe cra-report --deep --output $(Build.ArtifactStagingDirectory)/cra-report.html
    displayName: 'Generate CRA Report'
    env:
      GITHUB_TOKEN: $(GITHUB_TOKEN)

  - task: PublishBuildArtifacts@1
    inputs:
      pathToPublish: $(Build.ArtifactStagingDirectory)
      artifactName: compliance-reports

dependency-health:
  image: mcr.microsoft.com/dotnet/sdk:10.0
  script:
    - dotnet tool install -g DepSafe
    - export PATH="$PATH:$HOME/.dotnet/tools"
    - depsafe analyze --fail-below 60
    - depsafe cra-report --deep --output cra-report.html
  artifacts:
    paths:
      - cra-report.html
    expire_in: 30 days
  only:
    - main
    - merge_requests

Add to your .csproj to enable build-time health checks:

<PropertyGroup>
  <!-- Enable health checking during build -->
  <DepSafeEnabled>true</DepSafeEnabled>

  <!-- Fail build if score below threshold (0 = disabled) -->
  <DepSafeFailBelow>60</DepSafeFailBelow>

  <!-- Warn if score below threshold -->
  <DepSafeWarnBelow>80</DepSafeWarnBelow>

  <!-- Skip GitHub API for faster builds -->
  <DepSafeSkipGitHub>true</DepSafeSkipGitHub>
</PropertyGroup>

# Run health check manually
dotnet msbuild -t:DepSafeCheck

# Generate health report
dotnet msbuild -t:DepSafeReport

# Check license compatibility
dotnet msbuild -t:DepSafeLicenseCheck

# Generate badges
dotnet msbuild -t:DepSafeBadges

DepSafe integrates with multiple data sources:

If you encounter rate limiting errors:

1. Set GITHUB_TOKEN environment variable
2. Use --skip-github for faster runs without GitHub data
3. Run during off-peak hours

DepSafe automatically detects project type:

• .NET only - Contains .csproj, .sln, or Directory.Build.props
• npm only - Contains package.json without .NET files
• Mixed - Contains both .NET and npm files

If a vulnerability doesn't apply to your usage:

1. Check the vulnerability details in the report
2. Create a VEX document to document your assessment
3. Use .cra-config.json to add compliance notes

Contributions are welcome! Please feel free to submit issues and pull requests.

This software is provided for informational purposes only and does not constitute legal, compliance, or security advice.

The compliance assessments, health scores, vulnerability reports, and other outputs generated by this software are based on automated analysis and publicly available data sources. They may be incomplete, inaccurate, or outdated.

• Users are solely responsible for verifying compliance requirements with qualified professionals
• Security assessments should be validated with appropriate security experts
• Use of this software does not establish compliance with any regulation, including the EU Cyber Resilience Act (CRA)
• The authors are not liable for any damages resulting from use of this software

USE AT YOUR OWN RISK.

AGPL-3.0 - see LICENSE for details.

• OSV - Open Source Vulnerability database
• CISA KEV - Known Exploited Vulnerabilities catalog
• FIRST EPSS - Exploit Prediction Scoring System
• BSI TR-03183-2 - SBOM requirements for CRA
• SPDX - Software Package Data Exchange
• CycloneDX - Software Bill of Materials standard
• OpenVEX - Vulnerability Exploitability eXchange
• Sigil.Sign - Artifact signing and verification