reachable

reachable is a local-first CLI for JavaScript and TypeScript that answers the question developers ask after npm audit: is the vulnerable code path actually reachable from my application?

It parses JavaScript and TypeScript with tree-sitter, builds a project call graph, queries OSV advisories, and reports whether the vulnerable symbol is reachable, unknown, or unreachable from your entry points.

Live page: merup.me/reachable

The point is not to replace package-level scanners. It is to rank the work that actually matters by asking the next question those tools cannot answer on their own: does your code reach the vulnerable symbol?

• Cut false-positive dependency noise by separating REACHABLE, UNKNOWN, and UNREACHABLE findings.
• Fail CI on code paths that actually matter instead of every advisory in the lockfile.
• Run locally or in GitHub Actions without a hosted service, account, or API key.

Why reachable?

npm audit reports package-level risk. It does not know whether your code imports or calls the vulnerable function. That leads to noisy CI failures, broad dependency upgrade churn, and teams ignoring entire audit reports.

reachable adds source-aware triage:

• It traces entry points through your code instead of flagging every installed vulnerable package equally.
• It separates REACHABLE, UNKNOWN, and UNREACHABLE findings so real risk rises to the top.
• It works locally in CI without a hosted service, account, or API key.

Why Not Just npm audit?

| Tool | Flags vulnerable packages | Checks whether your code reaches the vulnerable symbol | Local-first CLI | | --- | --- | --- | --- | | reachable | Yes | Yes | Yes | | npm audit | Yes | No | Yes | | Dependabot alerts | Yes | No | No |

Installation

npm install -g @merupatel/reachable

Run without installing globally:

npx @merupatel/reachable@latest scan

Quick Start

Scan the current project:

reachable scan --format table

Example terminal output:

REACHABLE
+-----------+---------+----------------------+------------+-------------------+
| Severity  | Package | GHSA ID              | Status     | Vulnerable Symbol |
+-----------+---------+----------------------+------------+-------------------+
| HIGH      | lodash  | GHSA-xxxx-yyyy-zzzz  | REACHABLE  | trim              |
+-----------+---------+----------------------+------------+-------------------+
  src/index.ts::module
  src/index.ts::call:lodash.trim:12

UNREACHABLE
+-----------+---------+----------------------+--------------+-------------------+
| Severity  | Package | GHSA ID              | Status       | Vulnerable Symbol |
+-----------+---------+----------------------+--------------+-------------------+
| HIGH      | lodash  | GHSA-aaaa-bbbb-cccc  | UNREACHABLE  | trim              |
+-----------+---------+----------------------+--------------+-------------------+

Trace a package from the entry point:

reachable trace lodash

Inspect a single file's imports, exports, and reachable symbols:

reachable graph src/index.ts

Configuration

reachable loads project configuration from .reachablerc.json or reachable.config.js.

Example:

{
  "entry": ["src/index.ts", "src/worker.ts"],
  "failOn": "high",
  "ignore": ["GHSA-xxxx-xxxx-xxxx"],
  "devPackages": ["vitest", "@types/node"],
  "cache": {
    "ttlHours": 24,
    "dir": ".reachable-cache"
  }
}

Configuration fields:

| Field | Type | Description | | --- | --- | --- | | entry | string[] | Explicit entry points when auto-detection is not enough | | failOn | critical \| high \| moderate \| low \| all | Minimum reachable severity that sets a failing exit code | | ignore | string[] | GHSA IDs to suppress | | devPackages | string[] | Packages treated as dev-only and excluded from lockfile analysis | | cache.ttlHours | number | Advisory cache TTL | | cache.dir | string | Advisory cache directory |

Flags Reference

reachable scan

| Flag | Type | Default | Description | | --- | --- | --- | --- | | --entry <files...> | string[] | auto-detect | Override detected entry points | | --format <format> | table \| json \| sarif \| markdown | table | Output format | | --fail-on <severity> | critical \| high \| moderate \| low \| all | high | Failure threshold | | --reachable-only | boolean | false | Show only reachable advisories | | --no-cache | boolean | false | Ignore and clear the local advisory cache | | --dry-run | boolean | false | Skip remote advisory fetches and use cache only | | --quiet | boolean | false | Suppress formatter output | | --depth <number> | number | 20 | Maximum traversal depth | | --ignore <ids...> | string[] | [] | Ignore GHSA identifiers | | --cwd <path> | string | current directory | Project root to analyze | | --verbose | boolean | false | Enable debug logging |

reachable trace

reachable trace <package> [--cwd <path>] [--entry <files...>]

reachable graph

reachable graph <file> [--cwd <path>] [--entry <files...>]

CI Integration

Minimal GitHub Actions usage:

name: Reachability

on:
  pull_request:

jobs:
  reachable:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npx @merupatel/reachable@latest scan --format markdown --fail-on high

Use --format sarif to feed GitHub code scanning or --format markdown to post PR-friendly summaries.

Development

npm ci
npm run lint
npm run test
npm run test-integration
npm run build

The project uses:

• tree-sitter for source parsing
• commander for the CLI
• vitest for unit and integration tests
• semantic-release for release automation

See CONTRIBUTING.md for the contributor workflow.