Verifi
Fix your software supply chain, automatically.
Verifi safely fixes the risky dependencies in your software.
The whole tree
Resolve every dependency, direct and transitive. npm today, more ecosystems on the way.
Read-only
It reads and reasons. Nothing in your repository changes.
An SBOM when you need it
Add --sbom for a CycloneDX bill of materials, or --json for the raw tree.
How Verifi fixes a risky dependency
Upgrade
When a vulnerable package has a known-good release, Verifi moves it to the nearest safe version, one that actually exists on the registry, not blindly the latest.
Fixing vulnerabilitiesRemove
When a direct dependency is vulnerable and your code never imports it, Verifi takes it out of your tree, clearing the advisory at zero compatibility risk.
Usage signalPreview
verifi fix shows you the exact change and writes nothing. You see what will move, and why, before anything happens.
verifi fixApply
Add --apply and Verifi runs the package manager to make the change, updating your manifest and lockfile. Then you run your tests.
verifi fix
Questions, answered
In your terminal and in your CI. It's a CLI, so it runs locally on your machine and as a step in your build pipeline: GitHub Actions, GitLab CI, Jenkins, or anything that can run a shell command.
Yes. The CLI is open source and free to use. It lives on GitHub, so you can read exactly what it does, run it, and contribute.
Just your software. Point Verifi at it and it maps out every dependency, with no account, no agent, and nothing to install into your code.
npm to start, with more ecosystems on the way. It maps every dependency in your software, both direct and transitive.
No. Verifi pulls the fix-path data to you, not your code to us. Resolving and fixing happen locally; your source never leaves your environment.
For anything with a known fix, it upgrades the package to a safe version, or removes a direct dependency your code never imports. verifi fix previews the change and writes nothing; add --apply to make it. When there is no fix yet, it says so rather than inventing one.
Read up on the threat landscape
Introducing the Verifi CLI: the safe fix for your vulnerable dependencies
Decide, Then Fix: The Only Two Steps That Matter
Adversaries Are Publishing at Scale. Speed Is Now the Only Defence.
H2 2026: Packages Are the New Phishing Email, and Your Secrets Are the Target
Mini Shai-Hulud: The Self-Replicating npm Worm That Should Change How You Think About Dependencies
From Detection to Orchestration in Software Supply Chain Security
Built for teams
who ship fast
Supply-chain risk, dependency fixes, and how-tos. Delivered monthly to your inbox.
You can unsubscribe at any time.