I built a free in-browser EU CRA Article 14 checker — paste a lockfile, nothing uploaded

说明与用途

基于浏览器的检查器快速识别锁文件中已知被利用的依赖项，帮助及时遵守 EU CRA Article 14，且不上传任何数据。

问题

Developers need a quick, privacy‑preserving way to determine if a product’s dependencies contain actively exploited vulnerabilities that trigger EU Cyber Resilience Act Article 14 reporting obligations.

结果

The tool delivers a privacy‑preserving, 10‑second assessment of whether any dependencies in a lockfile are actively exploited per Article 14, enabling timely compliance actions without uploading data.

工作流

• Paste a lockfile (package‑lock.json, requirements.txt, go.sum, etc.) into the web form at cra.toledotechnologies.com/check.
• The browser sends package names/versions to OSV.dev API to retrieve advisories and CVE aliases.
• The page locally loads a mirrored CISA KEV JSON feed (same‑origin) and cross‑checks advisories against KEV entries.
• The result displays known‑exploited components, warning deadlines, and a clean/dirty status.
• If needed, run the CLI version (cra-watch) in CI to scan all lockfile formats and exit non‑zero on a match.
• Schedule the CLI scan regularly to catch new KEV entries that may affect a previously clean repo.
• Document the decision and timing for compliance records.

证据

It runs entirely in your browser. Your file contents never reach a server of mine — package names and versions go to the public OSV.dev API for lookup, and the KEV comparison happens locally in the page.

来源

The checker resolves your declared dependencies against OSV.dev, maps every advisory to its CVE aliases, and intersects that with the CISA KEV catalogue.

来源

CISA's KEV feed sends no CORS headers, so you cannot fetch it from a browser. I mirror it same-origin...

来源