vet (SafeDep)

What it is

The vet GitHub README (SafeDep). Beyond what the summary states, the page documents install methods, ready-to-run scan/policy commands, exact input coverage, and — most importantly — a deprecation that changes how malware scanning works.

How it works

Pipeline architecture: readers ingest manifests/repos/images/SBOMs → enrichers add vulnerability, malware, and OpenSSF Scorecard data from SafeDep Cloud → the CEL policy engine evaluates → reporters emit SARIF, JSON, CSV, or Markdown. Malware detection is no longer done locally on-demand; vet now queries SafeDep Cloud's threat-intelligence DB, which is populated continuously by static and dynamic behavioral analysis with human-in-the-loop triage and a public analysis log.

What to do

Install:

brew install vet
npm install -g @safedep/vet

Core scans (no API key needed for malware lookups):

vet scan -D . --malware-query
vet scan -D . --filter 'vulns.critical.exists(p, true)' --filter-fail

CEL policy examples:

vet scan --filter 'licenses.contains_license("GPL-3.0")' --filter-fail
vet scan --filter 'scorecard.scores.Maintained < 5' --filter-fail

Specialized targets:

vet scan --vsx --malware-query                  # VS Code extensions
vet scan -D .github/workflows --malware-query   # GitHub Actions
vet scan --image nats:2.10 --malware-query      # Container images

Container run:

docker run --rm -v $(pwd):/app ghcr.io/safedep/vet:latest scan -D /app --malware-query

CI: GitHub safedep/vet-action@v1 (with policy: pointing at a policy YAML); GitLab component: gitlab.com/safedep/ci-components/vet/scan@main.

Caveats

• On-demand/active malware scanning has been retired. The --malware flag is deprecated and now behaves identically to --malware-query (kept only for backward compatibility). If you relied on local active analysis of a package, it no longer exists — everything is now a lookup against SafeDep's known-malicious DB.
• vet inspect malware (on-demand analysis of a single package) is deprecated and will be removed in a future release; use vet scan --malware-query instead.
• Coverage boundaries the page states: package managers npm, PyPI, Maven, Go, Ruby, Rust, PHP; containers Docker/OCI; SBOMs CycloneDX/SPDX; source GitHub/GitLab.
• Zero-day / behavioral malware detection requires SafeDep Cloud access; the CLI's local --malware-query only checks packages against the already-populated threat-intel DB (example IDs: MAL-2025-4339 eslint-config-airbnb-compat, MAL-2025-4029 ts-runtime-compat-check).