Checking EU Cyber Resilience Act 24‑hour reporting trigger with cra‑watch

说明与用途

团队需要快速判断其产品中的漏洞是否正在被主动利用，以满足欧盟CRA的24小时报告期限。cra‑watch工具自动检查依赖项，将其与OSV.dev和CISA KEV目录进行比较，并输出匹配报告和后续操作指南。

问题

Teams need to know if a vulnerability in their product is actively exploited to trigger the EU CRA 24‑hour early‑warning reporting clock.

结果

Teams can reliably determine whether their product triggers the CRA 24‑hour reporting clock, reducing uncertainty and ensuring timely compliance.

工作流

• 1. Install cra‑watch via curl and make executable.
• 2. Run ./cra-watch scan to resolve dependencies and compare against OSV.dev and KEV.
• 3. Review output: if KEV matches, decide if the vulnerability is reachable in your product and trigger the 24‑h clock.
• 4. Schedule the scan in CI (e.g., GitHub Actions) with a cron trigger to catch new KEV entries.
• 5. Document the decision and evidence in an evidence log for compliance.
• 6. If a KEV match is confirmed, file the early warning, notification, and final report per CRA timelines.

证据

"If a vulnerability in a product you've placed on the EU market is being actively exploited, you owe an early warning to your coordinating national CSIRT and ENISA within 24 hours of becoming aware of it."

来源

"It reads your lockfiles, resolves them against OSV.dev, and intersects the result with the CISA Known Exploited Vulnerabilities catalogue — the closest thing to a public register of what's genuinely being exploited in the wild."

来源