🛡️ x2y-guardian

A professional command-line tool for cross-language dependency vulnerability scanning and analysis. Built by x2y dev tools | Leverages the OSV (Open Source Vulnerability) database for precise vulnerability data.

🔗 Links

• GitHub Repository: https://github.com/x2yDevs/x2y-guardian
• npm Package: https://www.npmjs.com/package/x2y-guardian
• More x2y Tools: https://x2ydevs.xyz

📝 Description

x2y-guardian is designed for developers and security teams who want a unified solution for scanning projects across multiple languages and package managers. By leveraging the OSV (Open Source Vulnerability) database and aggregating data from key security advisories, it provides accurate, up-to-date vulnerability information for dependencies, ensuring safe and secure software projects.

✨ Key Features

• Multi-language Support: Scan JavaScript/Node.js, Python, Java (Maven, Gradle), Go, Rust, PHP, and Ruby projects with a single tool.
• Precise Vulnerability Matching: Accurate mapping of vulnerabilities to package versions using the OSV schema.
• Comprehensive Audit: Detects outdated dependency versions in all supported ecosystems.
• Advanced Parsing: Supports complex scenarios like nested modules, dev-dependencies, Maven dependencyManagement, replace directives in Go, and Gemfile/Gemfile.lock in Ruby.
• Multiple Output Formats: Console output for development and JSON for easy integration into CI/CD pipelines.
• Cross-platform: Compatible with Windows, macOS, and Linux.

🌐 Supported Ecosystems

| Language/Ecosystem | Files Scanned | Package Manager | | :--- | :--- | :--- | | JavaScript/Node.js | package.json | npm | | Python | requirements.txt, pyproject.toml | pip | | Java | pom.xml, build.gradle, build.gradle.kts | Maven, Gradle | | Go | go.mod | Go Modules | | Rust | Cargo.toml | Cargo | | PHP | composer.json | Composer | | Ruby | Gemfile, Gemfile.lock | RubyGems |

🚀 Installation

Install globally via npm:

npm install -g x2y-guardian

🛠️ Usage

Commands

• x2y-guardian hello: Display a friendly greeting and check basic functionality.

• x2y-guardian scan: Scan the current project directory for dependency vulnerabilities.

• x2y-guardian audit: Audit dependencies to detect outdated versions.

Scanning Examples

Use the --path and --output flags to customize your scan:

Bash

# Display greeting
x2y-guardian hello

# Scan current project in the default console format
x2y-guardian scan

# Scan a specific path with console output
x2y-guardian scan --path /path/to/your/project --output console

# Scan a specific path and output results as JSON
x2y-guardian scan --path /path/to/your/project --output json

# Audit dependencies for outdated versions
x2y-guardian audit

📚 Data Sources

x2y-guardian aggregates and normalizes vulnerability data from various authoritative sources, adopting the OSV (Open Source Vulnerability) schema for maximum accuracy and compatibility:

• GitHub Security Advisories

• PyPA (Python Package Authority)

• RustSec (Rust Security Advisory Database)

• Global Security Database

⚖️ License

This project is licensed under the MIT License, the same as the core x2y SDK. See the LICENSE file for full details.