Vulnerability Package Inspector (vulpi)

vulpi reads a CycloneDX SBOM and an OSV Scanner vulnerability report, builds the dependency graph, and prints a vulnerability summary grouped by top-level dependencies.

1. Installation

Build the release binary:

cargo build --release

The binary is available at:

target/release/vulpi

Optional: install the command into your local Cargo PATH:

cargo install --path .

2. Generate SBOM With npx

Use npx @cyclonedx/cdxgen to generate a CycloneDX JSON SBOM without adding project dependencies or configuration.

Java (Maven projects)

npx @cyclonedx/cdxgen -t java -o bom.json

npm

npx @cyclonedx/cdxgen -t npm -o bom.json

Python

npx @cyclonedx/cdxgen -t python -o bom.json

PHP / Composer

npx @cyclonedx/cdxgen -t composer -o bom.json

3. Usage

Show help:

vulpi --help

Generate a report from a SBOM and OSV Scanner report:

vulpi \
  --sbom tests/fixtures/webgoat/bom.json \
  --osv-scanner-report tests/fixtures/webgoat/osv-report.json

Generate a report and export detailed CSV output:

vulpi \
  --sbom tests/fixtures/webgoat/bom.json \
  --osv-scanner-report tests/fixtures/webgoat/osv-report.json \
  --output vulpi-report.csv

vulpi \
  --sbom tests/fixtures/angular/bom.json \
  --osv-scanner-report tests/fixtures/angular/osv-report.json \
  --output vulpi-report.csv

4. Command arguments

Usage: vulpi [OPTIONS] --sbom <PATH> --osv-scanner-report <PATH>

• -s, --sbom <PATH>: path to the CycloneDX SBOM JSON file. Required.
• --osv-scanner-report <PATH>: path to the OSV Scanner vulnerability report JSON file. Required.
• -o, --output <PATH>: write detailed vulnerability records as CSV.
• -h, --help: show help.
• -V, --version: show version.

Useful environment variable:

• NO_COLOR=1: disable ANSI colors in output.