@absolutejs/vulnerabilitiesv0.14.1betaPlatform & InfraScanner-neutral vulnerability normalization, policy gates, host inventory, and audit-ready evidence for AbsoluteJS applications.
bun add @absolutejs/vulnerabilitiesRun the policy engine against a deterministic Grype-shaped fixture before connecting a real scanner or signing release evidence.
import {
createVulnerabilityEvidence,
summarizeGrypeReport
} from '@absolutejs/vulnerabilities';
const report = {
matches: [{
artifact: { name: 'openssl', type: 'deb', version: '3.0.0' },
vulnerability: {
id: 'CVE-LOCAL-1',
namespace: 'fixture',
severity: 'High'
}
}]
};
const counts = summarizeGrypeReport(report);
const evidence = createVulnerabilityEvidence({
asset: { id: 'sha256:local-fixture', kind: 'container' },
scan: {
...counts,
databaseBuiltAt: null,
scannedAt: new Date().toISOString(),
scanner: 'fixture'
}
});
console.log(evidence.result.status, evidence.result.violations);Reusable vulnerability-management primitives for AbsoluteJS applications. The package normalizes scanner output, applies explicit severity thresholds, collects Debian/Ubuntu host inventory through a deploy-compatible target, and produces evidence objects suitable for storage or compliance reporting.
Version 0.2.0 also defines the canonical contracts shared by feed adapters, scanner adapters, persistence layers, remediation workers, and host applications. Assets, components, advisories, scanner observations, managed findings, VEX decisions, risk assessments, remediation plans, and execution evidence all carry an explicit contract version.
It deliberately preserves distribution package versions and vendor security status. A version such as 1.24.0-2ubuntu7.5 must not be reduced to upstream 1.24.0: Ubuntu and other distributions backport security fixes without changing the upstream version, and discarding the distro revision creates false positives.
Host collection is structurally compatible with @absolutejs/deploy targets:
Scanner execution, scheduling, persistence, remediation approvals, and user interfaces remain application concerns. This package owns the contracts and decisions those applications should not hand-roll.
The remediation lifecycle keeps deployment success separate from security verification. A successful execution requires deployment evidence, and a finding becomes fixed only after a later inventory observation proves it is absent. Remediating findings remain open while that verification is pending.
Inventory correlation is ecosystem-aware and fails closed when a version scheme cannot be compared. osv.ecosystem on a component preserves vendor release context such as Ubuntu:24.04 while the component purl remains a standard pkg:deb identifier.
Managed finding identities are deterministic and scanner-independent:
Alias order, duplicate aliases, and identifier case do not change the result. Changing the tenant, asset, component identity, or vulnerability identity does.
Version comparison is ecosystem-aware and explainable. Debian/Ubuntu revisions, epochs, and backport suffixes are preserved rather than reduced to upstream versions. SemVer, Go module, Python PEP 440, and NuGet versions use their native ordering rules.
RPM, APK, and Maven comparisons require a verified adapter. Without one, the package returns unknown; it never substitutes lexicographic or generic SemVer ordering for an ecosystem it cannot compare defensibly.
Feed adapters share cursor, snapshot, cache, and failure-isolation contracts. Applications can persist snapshots in their own storage while keeping provider fetching separate from policy and remediation logic.
Alert operations can use VulnerabilityAlertConfiguration to keep evaluation SLAs, severity-specific escalation timing, and opened/escalated/resolved notification routing in one validated contract. Use validateVulnerabilityAlertConfiguration at persistence boundaries and resolveVulnerabilityAlertAudiences when queuing deliveries. Owner routes fall back to administrators when an alert has no owning asset.
An adapter can replace a complete provider snapshot or incrementally merge records and deletions. not_modified responses require an existing cached snapshot, and provider failures never erase the last successful snapshot.
Production stores remain replaceable through the FeedSnapshotStore, FeedSyncRunStore, and ManagedFindingStore contracts. Recorded refreshes persist status, errors, revisions, timestamps, and record counts without coupling feed orchestration to a database driver.
Deployment admission can retain a signed OSV and CISA KEV snapshot instead of calling upstream providers on the activation path. Exact package/version coverage is part of the signed payload, including queries that returned no advisories, so missing intelligence cannot be interpreted as a clean result.
Client evidence can be wrapped in an Ed25519 bundle that binds the runtime SBOM, signed intelligence snapshot, admission decision, and the exact VEX exceptions used. Verification requires only the public key. Cross-signed key transitions preserve trust when an operator rotates the signing identity.
Private keys remain an application secret. Published trust anchors contain only the key ID, fingerprint, creation time, algorithm, and DER public key.
Key creation, rotation, and revocation can also be recorded in a signed, hash-chained transparency log. A client pins the genesis key fingerprint, the latest log head, or both through a trusted out-of-band channel. This detects rewritten or truncated history and rejects bundles signed by revoked keys.
The command exits 0 only for trusted evidence, 1 for cryptographically valid but untrusted or revoked evidence, and 2 for invalid input or usage. When a registry includes a receipt from an independent witness, the optional witness fingerprint requires that receipt to match the exact log head and size. Applications that use multiple independent witnesses can call verifyEvidenceWitnessQuorum; duplicate receipts from one identity never count more than once toward the required quorum.
The security result is an independently verifiable evidence chain, not merely a scanner report.
Outcomes
Reusable vulnerability-management primitives for AbsoluteJS applications. The package normalizes scanner output, applies explicit severity thresholds, collects Debian/Ubuntu host inventory through a deploy-compatible target, and produces evidence objects suitable for storage or compliance reporting.
Version comparison is ecosystem-aware and explainable. Debian/Ubuntu revisions, epochs, and backport suffixes are preserved rather than reduced to upstream versions. SemVer, Go module, Python PEP 440, and NuGet versions use their native ordering rules.
Feed adapters share cursor, snapshot, cache, and failure-isolation contracts. Applications can persist snapshots in their own storage while keeping provider fetching separate from policy and remediation logic.
Hardening checklist
Follow in order
# @absolutejs/vulnerabilities
import {
assertVulnerabilityPolicy,
createVulnerabilityEvidence,
summarizeGrypeReport
} from '@absolutejs/vulnerabilities';
const counts = summarizeGrypeReport(await Bun.file('grype.json').json());
assertVulnerabilityPolicy(counts, {
maximums: { critical: 0, high: 0 }
});
const evidence = createVulnerabilityEvidence({
asset: { id: imageDigest, kind: 'container' },
scan: {
...counts,
databaseBuiltAt: grypeDatabaseBuiltAt,
scannedAt: new Date().toISOString(),
scanner: 'grype'
}
});# @absolutejs/vulnerabilities
import { collectDebianHostInventory } from '@absolutejs/vulnerabilities/host';
const inventory = await collectDebianHostInventory(deployTarget);Version comparison is ecosystem-aware and explainable. Debian/Ubuntu revisions, epochs, and backport suffixes are preserved rather than reduced to upstream versions. SemVer, Go module, Python PEP 440, and NuGet versions use their native ordering rules.
import {
comparePackageVersions,
evaluateVersionConstraints
} from '@absolutejs/vulnerabilities';
comparePackageVersions({
ecosystem: 'ubuntu',
left: '1.24.0-2ubuntu7.4',
right: '1.24.0-2ubuntu7.5'
});
evaluateVersionConstraints({
ecosystem: 'ubuntu',
installedVersion: '1.24.0-2ubuntu7.4',
constraints: [
{ operator: 'gte', version: '1.24.0' },
{ operator: 'lt', version: '1.24.0-2ubuntu7.5' }
]
});Feed adapters share cursor, snapshot, cache, and failure-isolation contracts. Applications can persist snapshots in their own storage while keeping provider fetching separate from policy and remediation logic.
import { createMemoryFeedStore, syncFeed } from '@absolutejs/vulnerabilities';
const result = await syncFeed({
adapter,
maxStaleMs: 24 * 60 * 60 * 1_000,
store: createMemoryFeedStore()
});
if (result.status === 'stale') {
// Cached intelligence remains available, with the provider error attached.
}Supported entry points declared by this project’s package manifest. Internal dist paths are not part of the package contract.
Public package entry point declared in package.json.
Scripts declared by this project’s package manifest.
Search the declarations exported by the current package type files. Expand a symbol to inspect its source-backed signature.
const VULNERABILITY_CONTRACT_VERSION: 1;@absolutejs/vulnerabilitiesThese playbooks show where this package fits, how to verify the combined system, and what changes before production.