Stop drowning in CVE noise — meet VigilOps Your package.json has 347 transitive dependencies. Dependabot just filed 40 security alerts. You have no idea which ones actually matter. VigilOps is a free Node.js CLI that solves this: it s…

Sichere Programmierung dev.to 10.07.2026, 05:11 Uhr 4 Min. Lesezeit

↗ Quelle (dev.to)

Reagiere als Erste:r — dein Feedback zählt!

Stop drowning in CVE noise — meet VigilOps

Your package.json has 347 transitive dependencies. Dependabot just filed 40 security alerts. You have no idea which ones actually matter.

VigilOps is a free Node.js CLI that solves this: it scans your dependencies for CVEs via OSV.dev, filters out the noise using static reachability analysis, and auto-opens GitHub PRs with the actual fix.

The problem isn't vulnerabilities — it's triage

Dependency scanners flag everything in your tree. The CVE is real. The package version is correct. But does your code actually call the affected function?

Endor Labs' 2024 Dependency Management Report found that fewer than 9.5% of dependency vulnerabilities are reachable in a typical codebase. That's over 90% noise.

Filippo Valsorda — former Google Go Security Team lead — put it bluntly when Dependabot opened thousands of PRs against repos that didn't even import the affected package:

"Dependabot is a noise machine. It makes you feel like you're doing work, but you're actually discouraging more useful work."

The security industry has a word for this: alert fatigue. When every alert looks critical, none of them are.

What reachability filtering actually means

VigilOps builds a static call graph of your application. When it finds a CVE, it asks: "Is there a code path from this file to the vulnerable function?"

If the answer is no, VigilOps marks it as suppressed — not because the CVE doesn't exist, but because your code can't trigger it.

The tradeoff: scanners that assume static call graphs can miss dynamic require(name) patterns where packages are loaded at runtime. That's real. For most codebases, the signal-to-noise improvement is worth it.

Try it right now

Demo 1: Scan with reachability filtering (default)

\////////////////////

npx vigilops scan examples/vigilops-demo-lodash

////////////////////

This scans a demo project containing lodash with a known CVE. VigilOps analyzes the call graph and flags only the reachable vulnerability. Everything else is suppressed.

Demo 2: See everything — including suppressed CVEs

\////////////////////

npx vigilops scan examples/vigilops-demo-express --all

////////////////////

The --all flag shows the full picture: all CVEs including suppressed ones. This is useful when you need to audit your full dependency tree or when a compliance requirement asks for a complete vulnerability inventory.

How the auto-fix PR works

When VigilOps finds a reachable CVE with a patched version available, it can open a GitHub PR directly from the CLI:

\////////////////////

npx vigilops scan . --fix

////////////////////

It determines:

The exact upgrade path (accounting for transitive dependencies)

Whether the upgrade breaks your lockfile

The correct npm install / pnpm update command

The PR lands in your repo with context: which CVE, which function, and what was changed. You review it, you merge it. No guessing.

How VigilOps compares to what you're using now

	Dependabot	Snyk	VigilOps
Cost	Free	Paid tier	Free, open source
CVE database	GitHub DB	Proprietary + NVD	OSV.dev
Reachability analysis	None	Partial (JS/Java)	Full static call graph
Filters unreachable CVEs	No	Yes (paid tier)	Yes
Auto-fix PRs	Version bump only	Version bump	Context-aware fix
Works offline	No	Partial	Yes
GitHub-only	Yes	No	No

Dependabot flags a CVE because the package exists. VigilOps flags a CVE because your code can reach it.

Get started

\////////////////////

npm install -g vigilops

////////////////////

Or run it directly:

\////////////////////

npx vigilops scan .

////////////////////

For the auto-fix workflow, you'll need a GitHub token set as VIGILOPS_GITHUB_TOKEN in your environment.

Call to action: we need your feedback

This is an early-stage open-source tool. If you've been burned by Dependabot noise, or if you've tried tools like Snyk and found them too expensive for what you got — we want to hear from you.

Specifically:

What's your current triage workflow for dependency CVEs?

What would it take for you to trust a reachability filter over a raw CVE alert?

What friction points have you hit with existing tools?

Open an issue at https://github.com/Vigilops/vigilops or drop a commenthttps://github.com/Vigilops/vigilops below.

The goal is simple: only alert you when your code can actually be exploited. Everything else is noise, and noise has a cost.

VigilOps is free and open source. It queries OSV.dev, which aggregates advisories from multiple sources — no single advisory database is perfect, and neither is any scanner. Use VigilOps as part of your triage workflow, not as a replacement for security judgment.

CTI Threat Relationship Graph2 Knoten / 1 Relationen

CVE / Incident Software MITRE ATT&CK CWE Weakness IoC

IR-PLAYBOOK-RCEHIGH

Schritte anzeigen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

WAF MitigationSofort

Virtuelles Patchen am Reverse Proxy / WAF für gefährdete URL-Pfade und Payloads aktivieren.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

Web Shell ScanSofort

Web-Root auf neu angelegte Scripts, anomal modifizierte Dateien und Persistence scannen.

find /var/www -type f -name "*.php" -mmin -120

Outbound FilteringSofort

Ausgehenden Datenverkehr (Reverse Shells zu unbekannten IPs/Ports) blockieren.

ss -tunp | grep -E ":(4444|1337|8080|9001)"

Vendor Patching

Hersteller-Update in Staging validieren und schnellstmöglich in Produktion ausrollen.

apt update && apt --only-upgrade install <pkg>

1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate

Regeln anzeigen

Syntax validiert (0 Fehler)

title: Detect Exploitation - VigilOps Launch Article
id: 4734c62f-aa57-4ebd-8c6f-0600075e5c4e
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "VigilOps Launch Article" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("VigilOps Launch Article")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

message: "*VigilOps Launch Article*"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where Message has "VigilOps Launch Article"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 3 Min

The Dink on Apple TV: Release Date, Cast, Plot, and What to Expect

Apple iOS & macOS

NÄCHSTER BEITRAG 6 Min

React useObjectUrl Hook: Preview Files & Blobs Without Memory Leaks (2026)

Sichere ProgrammierungWeiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich VigilOps Launch Article.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC

Schnell-Prompts für Analysten

⚠️ DEFANGED SANDBOX VIEW (tsecurity.de): Alle Netzwerkindikatoren und URLs wurden neutralisiert (2 Indikatoren entschärft). Nur zur defensiven Analyse!

Format: python

#!/usr/bin/env python3
# Exploit Title: PoC for Target
import socket, sys
target = '192[.]168[.]1[.]10'
url = 'hxxp://target[.]local/vuln'
s = socket.socket()
s.connect((target, 80))
s.send(b'GET / HTTP/1.1\r\nHost: target.local\r\n\r\n')