AbsoluteJS

@absolutejs/vulnerabilities-worker

@absolutejs/vulnerabilities-workerv0.2.4betaPlatform & Infra

Continuous feed refresh, inventory correlation, VEX, risk, remediation, leases, health, and metrics for AbsoluteJS vulnerability management.

#Installation

BASH
bun add @absolutejs/vulnerabilities-worker

#Capabilities

Overview

Continuous vulnerability intelligence orchestration for AbsoluteJS.

The package refreshes EPSS, KEV, OSV, and Ubuntu intelligence under distributed leases; records every attempt; correlates advisories with software inventory; applies VEX decisions; assesses risk; drafts and reconciles remediation; and exposes scheduler, health, retry, and stage metrics.

Applications own their inventory source, persistence wiring, deployment evidence, audit sink, and process lifecycle. The worker owns continuous scheduling, distributed exclusion, retries, reconciliation ordering, events, and health.

Outcomes

What you can build

Build on the supported package contract

Use @absolutejs/vulnerabilities-worker through its supported public entry points.

Hardening checklist

Production guidance

Make every external boundary explicitPin the deployed @absolutejs/vulnerabilities-worker version, replace example or memory-backed dependencies with durable implementations, bound external calls, protect credentials, and emit enough evidence to retry or recover safely.

Follow in order

Troubleshooting path

1
Trace from the first failed boundary
Reproduce the smallest canonical @absolutejs/vulnerabilities-worker example, confirm the supported entry point and version in the API explorer, then inspect the first boundary that did not produce its documented result.

#@absolutejs/vulnerabilities-worker quick start

Partial snippet

# @absolutejs/vulnerabilities-worker

TS
import { createVulnerabilityIntelligenceWorker } from "@absolutejs/vulnerabilities-worker";

const worker = createVulnerabilityIntelligenceWorker({
  adapters,
  history,
  leases,
  stores,
  workerId: "security-worker-1",
});

await worker.runOnce();
console.log(worker.health());

#Public entry points

Supported entry points declared by this package manifest.

Package entry point declared in package.json.

@absolutejs/vulnerabilities-worker@absolutejs/vulnerabilities-worker/manifest@absolutejs/vulnerabilities-worker/manifest.json

#Package commands

Scripts declared by this package manifest.

bun run buildrm -rf dist && bun build src/index.ts src/manifest.ts --outdir dist --target=bun --external @absolutejs/manifest --external @absolutejs/queue --external @absolutejs/vulnerabilities --external '@absolutejs/vulnerabilities/*' --external @absolutejs/vulnerabilities-epss --external @absolutejs/vulnerabilities-kev --external @absolutejs/vulnerabilities-osv --external @absolutejs/vulnerabilities-postgres --external '@absolutejs/vulnerabilities-postgres/*' --external @absolutejs/vulnerabilities-ubuntu --external @sinclair/typebox && tsc -p tsconfig.build.json && absolute-manifest emit
bun run check:packagebun run format && bun run typecheck && bun run test && bun run verify-package && bun run build && bun run verify-package --artifacts
bun run formatprettier --write "./**/*.{ts,json,md}"
bun run testbun test
bun run typechecktsc --noEmit

#API reference

Search the declarations exported by the current package type files. Expand a symbol to inspect its source-backed signature.

26 symbols
VulnerabilityVexConfigurationtypePermalinkSource
TS
type VulnerabilityVexConfiguration = {
    decision: VexDecision;
    tenantId: string;
};
Exported from @absolutejs/vulnerabilities-worker