Supply Chain Auditor

When you install a single package from npm, PyPI, or crates.io, that package often depends on dozens of other packages. Those indirect ("transitive") dependencies make up the majority of your project's code footprint.

The Supply Chain Auditor (woof audit) inspects every package version installed in your project and checks it against the Open Source Vulnerability (OSV) database.

What woof audit Looks ForCopy Anchor Link

• Known security advisories (CVEs & GHSAs): Publicly reported bugs such as prototype pollution, path traversal, or denial-of-service flaws in older library versions.
• Compromised releases: Versions of legitimate packages that were published after a maintainer's account or publishing token was stolen.
• Malicious packages: Packages flagged and removed by ecosystem security teams for stealing credentials during install scripts.

Why Lockfiles Matter More Than ManifestsCopy Anchor Link

Rustywoof does not audit loose version ranges like "^1.4.0" in your Cargo.toml or package.json, because a range does not tell you which exact version is currently installed. Instead, it reads your resolved lockfiles:

• Rust: Cargo.lock
• Node.js / TypeScript: package-lock.json, pnpm-lock.yaml, yarn.lock
• Python: uv.lock, poetry.lock, requirements.txt

By reading the lockfile, Rustywoof checks the exact version numbers running in production.

Privacy and Local OSV CachingCopy Anchor Link

When woof audit queries api.osv.dev, it sends a single batched HTTP request containing only package names, version numbers, and ecosystem identifiers:

{  "queries": [    {      "version": "1.4.1",      "package": {        "name": "hyper",        "ecosystem": "crates.io"      }    }  ]}

To keep repeated runs fast and work offline, Rustywoof caches OSV results on disk. If you ever want to clear the local cache and force a fresh sync, run woof cache clean.

Tracing Where a Package Came From (woof sniff)Copy Anchor Link

When woof audit reports that an unfamiliar package deep in your dependency tree has a vulnerability, your first question is usually: "Which of my dependencies installed this?"

Run woof sniff <package-name> to print the dependency path from your root project down to that package:

woof sniff django

Dependency trace for django:
[email protected]
├── [email protected] (devDependencies)
└── [email protected] (dependencies)

Found 1 version of django

Or run woof sniff without arguments to view your project's full dependency tree:

woof sniff

Legend: production dependency, optional only, dev only

[email protected] /path/to/project-name
  ├── [email protected]
  ├── [email protected]
  ├── [email protected]
  ├── [email protected]
  ├── [email protected]
  │
  │   devDependencies:
  ├── @ianramy/[email protected]
  ├── @types/[email protected]
  ├── @types/[email protected]
  ├── @types/[email protected]
  ├── @types/[email protected]
  └── [email protected]

For a specific transitive package trace:

woof sniff fumadocs-core

Dependency trace for fumadocs-core:
[email protected]
├── [email protected] (dependencies)
└─┬ [email protected]
   └── [email protected] (dependencies)

Found 1 version of fumadocs-core

Once you know what needs updating, you can run woof remediate <package> <fixed-version> to update the package to a patched release.