Stop Triaging. Start Fixing. Introducing VigilOps

You've seen the alert. You've opened the PR. You've read the changelog. Then you realize: your code doesn't even call the vulnerable function.

Every week. Hundreds of teams drowning in CVE notifications for packages sitting dormant in their node_modules — dependencies they pulled in years ago, bundled by a transitive library, and never actually executed. Meanwhile, the real vulnerabilities get buried.

VigilOps is a free Node.js CLI that fixes this.

How VigilOps Works
VigilOps does three things:

Scans dependencies against OSV.dev — the open vulnerability database used by GitHub, PyPI, and npm
Runs static reachability analysis to filter out unreachable vulnerabilities (packages in your tree but never called by your code)
Auto-opens a GitHub PR with the fix
The result: you get one PR with one real vulnerability. Not a spreadsheet. Not a wall of Slack messages. A fix.

Demo
Here's a quick scan:

npx vigilops scan examples/vigilops-demo-lodash
And to see everything including suppressed (unreachable) deps:

npx vigilops scan examples/vigilops-demo-express --all
The --all flag shows what's in your dependency tree but not actually reachable from your code. That's what the noise looks like — and that's what VigilOps filters out.

Why This Is Different
Dependabot and Snyk scan your entire lockfile. They report every CVE in every package, regardless of whether your code ever touches the vulnerable surface. This creates alert fatigue that causes teams to eventually... stop reading.

VigilOps inverts the model: only surface vulnerabilities in code you actually call.

Dependabot: "Your project has 47 vulnerabilities" (but 40 are unreachable noise)
VigilOps: "Your project has 1 reachable vulnerability. PR is ready."
Quick Start
npm install -g vigilops
npx vigilops scan .
Authenticate with GitHub: https://github.com/Vigilops/vigilops

npx vigilops auth
That's it. The first run will scan, analyze, and open a PR if there's a fixable reachable vulnerability.

What's Included
OSV.dev integration — covers npm, PyPI, Go, Rust, Ruby, and more
Static analysis — identifies which packages are actually reachable from your entry points
GitHub PR automation — opens a PR with a pinned safe version and a summary of what changed
Suppress filters — if you want to see the full tree, use --all
GitHub
Questions, issues, contributions: https://github.com/Vigilops/vigilops

Try It
npx vigilops scan examples/vigilops-demo-lodash
Start with a demo repo or point it at any Node.js project. If it finds nothing, you now have confidence in your dependency tree. If it finds something — you have a PR waiting.

VigilOps is free and open source. Built for maintainers and small dev teams who've had enough of the noise