UBEL — Unified Bill / Enforced Law (Node.js)

Software supply-chain and source-code security: dependency scanning, an install-time firewall, AI-powered SAST, cloud misconfiguration scanning and external attack surface scanning.

UBEL is a zero-dependency, source-available (internal-use-only; see License) application security toolkit. This package (@arcane-spark/ubel-node) ships one CLI per job. Full details live in the full reference and the per-module READMEs.

Modules

| Module | What it does | Docs | | --- | --- | --- | | SCA | Resolves dependencies and scans them against OSV.dev and NVD in real time, with reachability analysis, KEV/EPSS exploit intelligence, license checks, CycloneDX SBOM and SARIF output. | SCA documentation | | Firewall | Gates npm/pnpm/bun/composer/pip/uv/pipx/conda/cargo/apt/dnf/yum installs and Docker images behind a scan before anything is installed. yarn/bundle/go/dotnet/dart/flutter/swift are gated on an existing lockfile instead (no lockfile, or any package argument, is refused). | Firewall details | | Secrets | Trivy-derived ruleset plus UBEL's own rules. Standalone via ubel-secrets. | Secrets details | | SAST | LLM-powered scan → verify → taint-trace pipeline for vulnerabilities, plus a separate malicious-code scan. | SAST documentation | | Cloud | Read-only AWS / GCP / Azure account scan for misconfigurations. | Cloud documentation | | EASM | Passive fingerprinting and misconfiguration checks of domains, hosts and ports you own. Authorized use only. | EASM documentation |

Every finding is also mapped to OWASP Top 10, PCI DSS, HIPAA, SOC 2, ISO/IEC 27001, NIST SP 800-53, GDPR and CIS Controls v8 (best-effort guidance, not a compliance assessment).

Capability matrix

| Ecosystem | SCA | Firewall | Pre-commit hook | SAST | Malware SAST | Reachability | License Compliance | Secrets | |---|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:| | Node.js (npm/pnpm/bun) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Node.js (yarn) | ✅ | ✅ (lockfile required) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Python (pip/uv/pipx/conda/poetry/venv) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | PHP (Composer) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Ruby (Bundler) | ✅ | ✅ (lockfile required) | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ | | Rust (Cargo) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ | | Go (modules) | ✅ | ✅ (lockfile required) | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ | | Java / Kotlin (Maven) | ✅ | ❌ | ⚠️ | ✅ | ✅ | ✅ | ❌ | ✅ | | C# / .NET (NuGet) | ✅ | ✅ (lockfile required) | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ | | Swift (SwiftPM / Carthage) | ✅ | ⚠️ (SwiftPM only, lockfile required) | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ | | Flutter / Dart (pub) | ✅ | ✅ (lockfile required) | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ | | C/C++ | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ | ✅ | | Docker images | ✅ (OS + app deps) | ✅ | — | — | — | — | ✅ | ✅ (in image) | | Kubernetes manifests | — | — | — | ✅ (misconfig) | — | — | — | ✅ | | Terraform / CloudFormation (IaC) | — | — | — | ✅ (misconfig) | — | — | — | ✅ | | Linux host (apt/dnf/yum) | ✅ | ✅ | — | — | — | — | ✅ | — | | Windows host | ✅ | ❌ | — | — | — | — | ✅ | — | | VS Code / Cursor / VSCodium extensions | ✅ | — | — | — | — | — | — | — |

✅ = built and shipped ("lockfile required" = the firewall scans an existing lockfile instead of resolving a candidate) · ⚠️ = partial, see that ecosystem's section in the full reference · ❌ = not currently possible/present for a stated reason · — = not applicable to that layer.

cargo caveat: only crates.io crates are scanned — git and alternative-registry dependencies are listed in a warning but not matched, and build.rs/proc-macros still run at cargo build, outside the firewall.

conda caveat: only conda packages that are Python distributions are matched against vulnerability data (OSV has no conda ecosystem); native packages such as openssl are inventoried but stay undetermined (they're not counted as safe, and each scan prints a warning with how many were left unmatched). See the SCA documentation.

Cloud account misconfiguration scanning (AWS/GCP/Azure, via ubel-cloud) isn't tied to a dependency ecosystem, so it doesn't have a row here — see the Cloud documentation.

Install

npm install -g @arcane-spark/ubel-node

Node.js >=18.0.0 required. ubel-pip/ubel-uv/ubel-pipx need Python on PATH; ubel-uv, ubel-conda, ubel-cargo and ubel-composer need their own binaries (ubel-cargo needs the Rust toolchain).

| Binary | Purpose | | --- | --- | | ubel-npm / ubel-pnpm / ubel-bun | SCA (health) and firewall (check / install) for JS projects | | ubel-yarn / ubel-bundle / ubel-go / ubel-dotnet / ubel-dart / ubel-flutter / ubel-swift | SCA (health) plus a lockfile-required firewall for yarn, Bundler, Go, .NET, Dart/Flutter and SwiftPM: check / install need the lockfile to already exist and take no package arguments | | ubel-composer | Same, for PHP | | ubel-pip / ubel-uv / ubel-pipx / ubel-conda | Same, for Python (ubel-conda: conda create --dry-run --json against a scratch prefix, then an exact-pinned --no-deps install) | | ubel-cargo | Same, for Rust: cargo add + cargo update --workspace resolved in a scratch copy of the project, then cargo fetch --locked of the scanned lockfile | | ubel-apt / ubel-dnf / ubel-yum | Same, for Linux packages | | ubel-docker | Scan or gate a container image | | ubel-secrets / ubel-license | Standalone secrets / license scans | | ubel-sbom | Fills a CycloneDX SBOM's vulnerabilities with its components' known vulnerabilities, enriched with CISA KEV and FIRST EPSS — looked up by purl (OSV), by CPE (NVD) only when a component has no usable purl. Writes nothing else: no reachability, no reports | | ubel-agent / ubel-cicd / ubel-platform | Fixed-configuration scans: AI-agent workspace, built CI/CD workspace, host | | ubel-sast / ubel-mal / ubel-chunk | Vulnerability SAST, malicious-code scan, chunking preview (no LLM cost) | | ubel-cloud | AWS / GCP / Azure misconfiguration scan | | ubel-url / ubel-domain / ubel-host / ubel-easm | EASM: known hosts, CT-log subdomain discovery, port sweep of the given IPs/domains, combined sweep | | every binary above | Also accepts three commands instead of a scan: <binary> asset-id (show the folder's asset id, creating it if there is none yet — every binary also creates it when it starts, and <binary> init does so explicitly), <binary> set-asset-id <id> (link the folder to an existing asset id so its scans join that asset's history) and <binary> version, plus get-machine-id / set-machine-id <id> for the machine id in ~/.ubel/ubel_machine.json, which every report also carries as machine_id — e.g. ubel-npm version, ubel-sast asset-id — and a --asset-id <uuid> flag that sets the asset id for a single run (written into the report, SBOM and SARIF, and used to file the history zip). See Asset id | | every report | Carries an asset_type — codebase, cloud, easm, machine, agent, editor or docker — saying what kind of thing was scanned (shown as Asset type in the HTML report). See Asset types | | every report | Has a unique report_id, UBEL-<tag>-<asset_id>-<report_uuid> — the same in its JSON, HTML, SBOM and SARIF. See Report ID |

Quick start

ubel-npm health                      # audit installed dependencies
ubel-npm check                       # firewall: dry-run, exit non-zero if policy blocks
ubel-secrets /path/to/project         # secrets-only scan
ubel-sast /path/to/project            # AI-powered vulnerability scan
ubel-cloud                           # providers you have credentials for
ubel-url staging.your-domain.example --fail-on high   # EASM, your own infrastructure only

CI exit codes

• SCA / firewall: exit 1 if policy blocks or the scan fails (including an incomplete OSV/NVD lookup — never treated as a pass).

• EASM: exit 2 when --fail-on is met. It gates on vulnerabilities, infections and web misconfigurations; KEV/EPSS rules apply to vulnerabilities. --fail-on none disables the gate.

• Cloud: governed by its own --fail-on.

See the CI/CD integration details for GitHub Actions and Docker examples.

Privacy

No telemetry and no UBEL-operated backend. Dependency scans send only package identifiers to OSV.dev and NVD (mirrorable via UBEL_OSV_ENDPOINT / UBEL_NVD_ENDPOINT), and CVE ids to FIRST.org's EPSS API. SAST sends code chunks to the LLM provider you configure — use a local endpoint if code must not leave your network. EASM and cloud scanners contact only the targets and APIs you point them at, plus public data sources documented in their READMEs.

License

Source-available, internal-use-only. Using and modifying UBEL for your organization's own needs (including its own CI/CD and products) is permitted. Redistribution, wrapping or embedding, exposing it to third parties over a network or API, and hosting or automating it as a service for others are not. Security consultants may use it manually during direct client engagements, provided it isn't left behind, automated, or made available to the client as a platform. See the license.

Links

• Repository

• Issues

• Full reference