Introducing the Verifi CLI: Find and Fix Vulnerable Dependencies in Your Build

Verifi is open source, and it starts with a single command-line tool. This is the smallest useful version of what we are building, and it is the one we wanted in our own pipelines first.

What it does

Point the CLI at a project and it resolves your full dependency tree, direct and transitive. Then it checks every dependency against three questions: is it vulnerable, is it end-of-life, and is it malicious?

Known vulnerabilities come from the public advisory databases. End-of-life status flags packages and runtimes that will never get another security fix. Malicious detection covers typosquats, dependency-confusion packages, and known-bad releases, with behavioural analysis for the novel malware that no list has caught yet.

It fixes, it does not just flag

Most tools stop at a report. The Verifi CLI does not. For any finding with a known fix, it bumps the version, direct or transitive, or replaces the package, and opens a pull request. There is nothing for you to copy-paste.

For findings without a fix path yet, it does the other useful thing: it fails the build. One policy, two modes. Fix what can be fixed, gate what cannot.

Built for CI

The CLI is a build step. It exits non-zero on a policy violation, so your existing CI gate reacts to it with no special integration. Run it locally to see what is in your tree, then run it in CI to keep the tree clean.

We are starting with known vulnerabilities that have a fix, because that is where the value is highest and the automation is safest. End-of-life and malicious remediation follow. The code is on GitHub. Read exactly what it does, then wire it in.