I built a free in-browser EU CRA Article 14 checker — paste a lockfile, nothing uploaded

Description and use

A browser‑only checker quickly identifies actively exploited dependencies in a lockfile, enabling timely EU CRA Article 14 compliance without uploading data.

Problem

Developers need a quick, privacy‑preserving way to determine if a product’s dependencies contain actively exploited vulnerabilities that trigger EU Cyber Resilience Act Article 14 reporting obligations.

Outcome

The tool delivers a privacy‑preserving, 10‑second assessment of whether any dependencies in a lockfile are actively exploited per Article 14, enabling timely compliance actions without uploading data.

Workflow

• Paste a lockfile (package‑lock.json, requirements.txt, go.sum, etc.) into the web form at cra.toledotechnologies.com/check.
• The browser sends package names/versions to OSV.dev API to retrieve advisories and CVE aliases.
• The page locally loads a mirrored CISA KEV JSON feed (same‑origin) and cross‑checks advisories against KEV entries.
• The result displays known‑exploited components, warning deadlines, and a clean/dirty status.
• If needed, run the CLI version (cra-watch) in CI to scan all lockfile formats and exit non‑zero on a match.
• Schedule the CLI scan regularly to catch new KEV entries that may affect a previously clean repo.
• Document the decision and timing for compliance records.

Evidence

It runs entirely in your browser. Your file contents never reach a server of mine — package names and versions go to the public OSV.dev API for lookup, and the KEV comparison happens locally in the page.

Source

The checker resolves your declared dependencies against OSV.dev, maps every advisory to its CVE aliases, and intersects that with the CISA KEV catalogue.

Source

CISA's KEV feed sends no CORS headers, so you cannot fetch it from a browser. I mirror it same-origin...

Source