future-architect/uzomuzo-oss

future-architect/uzomuzo-oss has 45 GitHub stars and 7 forks. GitHot measured 0 stars in 24 hours. Last checked 2026-11-15 00:56 UTC. Last push 2026-11-12.

So werden diese Zahlen gemessen

45 Sterne 7 Forks

What you can do

Multi-ecosystem support: 8 ecosystems with full PURL (Package URL) spec compliance
Build integrity grading: Supply chain build tamper resistance assessment using Scorecard checks and SLSA provenance — details
OpenSSF Scorecard integration: Automated security maturity metrics
Parallel-optimized batch processing: 5,000+ PURLs/run with concurrent API orchestration

Gemessener Sternzuwachs

in 24h: 0
in 7 days: Verlauf wird gesammelt
in 15 days: Verlauf wird gesammelt
in 1 month: Verlauf wird gesammelt

Nettoänderungen in überlappenden Zeiträumen, keine Tagessummen. Fehlende Messwerte bleiben leer. Sterne zeigen Interesse, nicht Qualität.

Über uns

Detect abandoned and end-of-life dependencies that CVE-based scanners don't flag, and rank which ones to remove first.

Entwicklerwerkzeuge

README.md

Original

📊 We analyzed 16,000 production packages: 48% have lifecycle risk. SCA tools like Trivy, Syft, and cdxgen detect none of them. (Presented at FIRST VulnCon 2026 — slides)

Find abandoned dependencies before they become vulnerabilities. Then remove them — in the right order.

uzomuzo does two things SCA tools can't:

uzomuzo scan — Detects unmaintained packages that SCA tools miss (no CVE, but no one is watching either)
uzomuzo diet — Ranks every dependency by removability: graph impact, source coupling, and health risk — so you know which to cut first

./uzomuzo scan pkg:npm/[email protected] — inflight has 556K dependents, yet its repository is archived and npm has deprecated it. uzomuzo detects this as EOL-Confirmed in seconds.

The Problem: The CVE Blind Spot

Standard SCA tools (Trivy, Syft, Snyk) excel at flagging known CVEs. But they cannot answer: is this package still maintained?

A package with zero CVEs today may have stopped being maintained. When a vulnerability is found, no fix may come — and the CVE record may not even list the version you run. (Apache Tomcat 8.5: CVE-2025-24813 was published on 2025-03-10 without 8.5 in its affected versions; 8.5 was added about five months later, on 2025-08-08.)

What SCA misses — EOL-Effective

--- Summary Table ---
STATUS     PURL                 LIFECYCLE      BUILD
🔴 replace  pkg:npm/[email protected]  EOL-Effective  —

── Summary ─────────────────────────────────────────────────
│ 1 dependencies | ✅ 0 ok | ⚠️ 0 caution | 🔴 1 replace | 🔍 0 review
└───────────────────────────────────────────────────────────

--- Detailed Report ---

--- PURL 1 ---
── pkg:npm/[email protected] ─────────────────────────────────────
│ A very fast streaming multipart parser for node.js
│ 🔴 EOL-Effective: Unmaintained, unpatched vulnerabilities
├─ Signals ─────────────────────────────────────────────────
│ Last Human Commit: 2023-07-15
│ Maintained Score: 0/10
│ Advisories: 1
│ Max Advisory Severity: HIGH 7.5
├─ Health ──────────────────────────────────────────────────
│ 188 stars
│ Dependents: 51 direct, 1270 total (deps.dev, packages resolving to 0.3.1)
│ Depends on: 1 direct, 0 transitive
│ Scorecard Overall: 2.8/10  Maintained: 0.0/10
│ Last Commit: 2023-07-15
├─ Releases ────────────────────────────────────────────────
│ Stable: 0.3.1 (2021-12-19)  ⚠️ 1 advisory
│   HIGH     (7.5)  GHSA-wm7h-9275-46v2
│   → https://deps.dev/npm/dicer/0.3.1
├─ Links ───────────────────────────────────────────────────
│ Repository: https://github.com/mscdex/dicer
│ Registry: https://www.npmjs.com/package/dicer
│ deps.dev: https://deps.dev/npm/dicer
└───────────────────────────────────────────────────────────

No official deprecation, no archived repository — yet dicer has an unpatched ReDoS vulnerability (CVSS 7.5 — HIGH severity) with zero human commits in over two years. SCA tools report "1 CVE" and move on. uzomuzo recognizes the combination of HIGH/CRITICAL unpatched advisory + maintenance absence as effectively end-of-life. This package sits in the Express dependency chain (via busboy → multer), meaning millions of applications silently depend on abandoned code.

Found in the wild — reported and tracked

We used uzomuzo to scan major OSS projects and reported findings upstream:

Project	Issue/PR	Finding
Grafana	grafana/grafana#121911	Archived Action in release pipeline — triggered internal fix
Vault	hashicorp/vault#31899	3 archived mitchellh packages in ACL layer
Trivy	aquasecurity/trivy#10484	Archived go-homedir — stdlib replacement PR
Next.js	vercel/next.js#92479	Deprecated @vercel/kv — @upstash/redis migration

All findings were invisible to standard SCA tools (zero CVEs). uzomuzo detected them in seconds. See the full scan results across 20 major projects.

Installation

Pre-built binaries (recommended)

Download the latest release from GitHub Releases.

Go install

go install github.com/future-architect/uzomuzo-oss/cmd/uzomuzo@latest

# Optional: install diet command for dependency removability analysis
go install github.com/future-architect/uzomuzo-oss/cmd/uzomuzo-diet@latest

Build from source

git clone https://github.com/future-architect/uzomuzo-oss.git
cd uzomuzo-oss
go build -o uzomuzo ./cmd/uzomuzo
CGO_ENABLED=1 go build -o uzomuzo-diet ./cmd/uzomuzo-diet  # requires C compiler

Quick Start

export GITHUB_TOKEN=ghp_...  # recommended; adds commit history, archive detection and fork detection

# Single package
uzomuzo scan pkg:npm/[email protected]

# GitHub repository
uzomuzo scan https://github.com/expressjs/express

# Scan project dependencies via SBOM (direct deps only — transitive issues
# are resolved by updating the direct dep that pulls them in)
trivy fs . --format cyclonedx | uzomuzo scan --sbom -
trivy fs . --format cyclonedx | uzomuzo scan --sbom - --show-transitive  # include transitive
uzomuzo scan                     # auto-detect go.mod in cwd (add --show-transitive for // indirect)
uzomuzo scan --format json       # JSON output for CI integration
uzomuzo scan --file go.mod --format sarif  # PR annotations, see docs/integration-examples.md

# Optional npm maintainer e-mail domain notice (makes RDAP requests; caches IANA's RDAP server list)
uzomuzo scan --maintainer-domain pkg:npm/[email protected]

# CI gate: exit 1 if any EOL dependency found
uzomuzo scan --sbom bom.json --fail-on eol-confirmed

# Batch from Trivy SBOM (show only packages that need replacement)
trivy fs --format cyclonedx ./my-project \
  | uzomuzo scan --sbom - --fail-on eol-confirmed,eol-effective --show-only replace

# Scan a repo's GitHub Actions dependencies
uzomuzo scan https://github.com/owner/repo --include-actions

# Scan a workflow YAML directly
uzomuzo scan --file .github/workflows/ci.yml

# File input (one PURL per line)
uzomuzo scan --file input_purls.txt --sample 500

--maintainer-domain is off by default and applies only to versioned npm inputs. It adds a notice for manual review without changing the scan verdict, in --format json (maintainer_domain) and the detailed view; table and CSV output are unchanged. The notice states what RDAP shows for the domain and when npm records first showed the maintainer with an address there, then what may happen (if the account still uses that address, npm password-reset mail may reach whoever holds or next registers the domain), and asks the user to check who published newer versions before upgrading. It may also state the account's last publish found in this package's npm records, or that no dated publish was found there, and whether the analysed version came from GitHub Actions trusted publishing. It names the account and the domain but not the address. See ADR-0030. When RDAP provides the registrar of a re-registered domain, the notice names it. The list of RDAP servers is fetched from IANA and cached under the user cache directory, with the copy built into the binary as the fallback.

Flagged npm findings also include publisher e-mail domain evidence from packuments already fetched in the same analysis batch. When the account's latest visible publish has a usable e-mail, the notice gains one sentence saying whether that publish used the same domain or another one, or that a newer publish exists whose publisher is not visible. The evidence never removes a notice and does not change the verdict.

Dependency Diet — Which dependency should I remove first?

Most projects have dependencies they don't really need, but knowing which ones to remove and how hard it will be is the real problem. uzomuzo diet answers both:

Experimental. Diet can report a dependency that is in use as unused or trivial. Check before removing; see Accuracy.

# Pipe from trivy (no intermediate file)
trivy fs . --format cyclonedx | uzomuzo diet --sbom - --source .

# Or two-step with a file
syft . --source-name myproject -o cyclonedx-json > bom.json
uzomuzo diet --sbom bom.json --source .

Real output — fastapi/fastapi (18 direct deps, 35 transitive, Trivy SBOM):

── Diet Plan (18 direct dependencies) ─────────────────────────

  Unused (0 imports):  4
  Quick wins:          3  (trivial/easy + high impact)

RANK  SCORE  EFFORT    PURL                                    REMOVES  REMAINS  IMPORTS  CALLS  STATUS
────  ─────  ──────    ────                                    ───────  ───────  ───────  ─────  ──────
1     0.42   trivial   pkg:pypi/[email protected]             0        -        0        0      Stalled
2     0.31   trivial   pkg:pypi/[email protected]                   0        yes      0        0      Active
3     0.30   trivial   pkg:pypi/[email protected]                    0        yes      0        0      Active
4     0.29   trivial   pkg:pypi/[email protected]    0        -        0        0      Active
5     0.19   easy      pkg:pypi/[email protected]             7        -        1        1      Active
6     0.14   easy      pkg:pypi/[email protected]                   1        -        1        1      Stalled
...
17    0.00   hard      pkg:pypi/[email protected]                0        yes      233      162    Active
18    0.00   hard      pkg:pypi/[email protected]               0        -        41       49     Active

── Dependency Tree ─────────────────────────────────────────────
  Direct deps:          18
  Transitive deps:      35
  └ removes-with-dep:   8  (removable if that direct dep is removed)
  ⚠ remains-indirect:   11  (remain in tree via another direct dep)

The ranking surfaces actionable insights: fastapi-cli (rank 5) removes 7 transitive deps with only 1 import — a high-impact, low-effort win. Bottom-ranked pydantic (233 files, 162 calls) is deeply embedded — the tool tells you not to start there.

Column	Meaning
SCORE	Overall removal priority (higher = remove first)
EFFORT	trivial (0 imports) / easy / moderate / hard
REMOVES	Transitive deps that disappear when this dep is removed
REMAINS	`yes` = stays in tree as indirect dep of another package
IMPORTS / CALLS	Source files and call sites — measures how hard to untangle

Supports Go, Python, JavaScript/TypeScript, Java. Uses tree-sitter for multi-language source analysis.

# Java (Maven) — requires CycloneDX Maven Plugin for dependency resolution
mvn org.cyclonedx:cyclonedx-maven-plugin:2.9.1:makeBom \
  -DoutputFormat=json -DoutputName=bom -Dcyclonedx.skipNotDeployed=false
uzomuzo diet --sbom target/bom.json --source .

From ranking to removal — the full pipeline

Diet doesn't just rank — it feeds into Claude Code skills that use an LLM to analyze, plan, and execute the removal:

uzomuzo diet              Rank all deps by removability        (automated)
       ↓
/diet-assess-risk         Trace data flows, build attack       (LLM-powered)
/diet-evaluate-removal    scenarios, evaluate cost-benefit
       ↓
/diet-remove              Safe removal: analysis → replace     (LLM-powered)
                          → verify → commit/issue

The key insight: detection is a tool's job, but deciding how to remove is an LLM's job. Diet provides the structured data (graph impact, coupling metrics, health signals), and the LLM skills read the actual source code to plan the migration. See Diet Workflow for the full pipeline.

See Diet Command for scoring algorithm and SBOM tool comparison, and Claude Code Skills for the LLM-powered removal workflow.

See Usage for full CLI reference and Integration Examples for Trivy, Syft, and Go module workflows.

Lifecycle Classification

uzomuzo classifies each package into one of seven lifecycle states using a multi-signal decision tree (OpenSSF Scorecard, human commit recency, release activity, registry EOL flags, advisory severity, and unpatched advisory counts):

Label	Meaning	Action
Active	Recent human commits + releases + healthy maintenance score	No action needed
Legacy-Safe	No recent activity, but no recorded advisories against the package or, where dependency data exists, its dependencies (or a high Scorecard `Vulnerabilities` score) — frozen and stable	Accept risk or pin version
Stalled	Maintenance declining: low score or commits stopped; repository archived/disabled without an explicit end-of-life signal; or an advisory database reports the whole package unmaintained	Monitor; plan migration
EOL-Confirmed	Registry explicitly declares end-of-life (deprecated / yanked / abandoned / relocation)	Migrate immediately
EOL-Effective	No official EOL, but HIGH/CRITICAL unpatched vulns together with either 2+ yrs without human commits or an advisory database reporting the package unmaintained (without commit data: a last release over 2 years old and a low or missing maintenance score). Where the package's only HIGH advisories are its dependencies', one counts only when it was published over 2 years ago, is not withdrawn, and its database rates it HIGH or CRITICAL or gives no rating; the Scorecard `Vulnerabilities` score branches are separate (ADR-0032)	Migrate; treat as EOL
EOL-Scheduled	Future EOL date announced (not yet reached)	Plan migration before EOL date
Review Needed	Insufficient data for automated classification; the registry has yanked every release, so no version is offered to normal dependency resolution; or (npm) the version was published in the last 7 days, after a year with no releases, together with versions on other release lines (other major versions, or other minor versions below 1.0) within a day: the way past takeovers of npm packages that had gone quiet have looked, and also how a returning maintainer's last fix to an old line can look (ADR-0026)	Manual investigation required

When a dormant package's HIGH advisories are all in its dependencies, the reason names the advisory that decided, and JSON has a dependency_advisory_age object with its status, its publication date when known and, when it is too recent to count, the day it will (eligible_on). If no dependency advisory qualifies and a failed OSV lookup decided the outcome, the status is unknown, the package is Stalled for that scan, and a warning counts such packages.

OSV malicious-package advisories are checked separately from the lifecycle label. A version named by a MAL- advisory or a GHSA tagged CWE-506 has status replace even when its lifecycle is Active or the package has disappeared from a registry. The detailed and table views name the advisory; JSON includes a malicious object, and CSV has a malicious_advisory column. A failed lookup is shown as malicious_check: "unknown" in JSON and produces a warning.

--fail-on malicious gates on these advisories. Any other non-empty --fail-on selection also fails when a malicious version is found, including a selection containing only eol-confirmed. See ADR-0027 for the matching rules and limits.

An npm version that came out after a year with no releases is marked as well (a prerelease only when it is part of a burst across release lines), next to whatever lifecycle label it has, for a week after it came out. The table view shows ⚠ 639d silence, the detailed view explains the release unless a malicious-package advisory already names the version (for a single-line return, also whether an OSV malicious-package record names it yet and when the marker clears), JSON includes a dormant_release object, and CSV has a dormant_release column. --fail-on dormant-release gates on the marker; no other --fail-on value implies it, because it is a heuristic, not a finding. See ADR-0028.

A version published within the last seven days (configurable) gets a release_age object in JSON, regardless of ecosystem or lifecycle label, and a young-release notice in detailed output unless a dormant-release marker or malicious advisory already covers it. JSON reports status: "unknown" when the publish time is missing, in the future, or not for the package the input names. See ADR-0031.

An archived or disabled repository keeps its lifecycle label (usually Stalled; see ADR-0020), and the fact is shown next to it: the table view appends · archived or · disabled, JSON has archived and disabled booleans, and CSV ends with archived and disabled columns. --fail-on archived and --fail-on disabled gate on them whatever the label — useful for GitHub Actions (--include-actions), which have no registry and so never get an EOL label. Both values require GITHUB_TOKEN. See ADR-0029.

What Makes uzomuzo Different

Capability	Trivy / Syft	OpenSSF Scorecard	endoflife.date	uzomuzo
Known vulnerability scanning	Yes	Partial	No	Partial (via deps.dev)
Single-repo health scoring	No	Yes (17 checks)	No	Yes (via Scorecard)
Dependency tree lifecycle assessment	No	No	No	Yes
Long Tail EOL detection	No	No	~400 projects	Multi-signal heuristic
Bot vs. human commit filtering	No	No	N/A	Yes
GitHub Actions health scanning	No	No	No	Yes
Lifecycle classification granularity	N/A	N/A	Binary (EOL/not)	7 actionable states
Batch processing scale	N/A	1 repo/run	N/A	5,000+ PURLs/run

Technical Novelty

Innovation	Why it matters
Human vs. bot commit separation	Repositories with only Dependabot/Renovate commits masquerade as maintained. uzomuzo filters automated commits to reveal true human activity.
7-state lifecycle model	Binary "EOL or not" is insufficient. Each state maps to a concrete remediation action.
Ecosystem-aware delivery model	Go modules deliver via VCS-direct; npm via registry publish. The same "commits without publish" signal means different things per ecosystem.
Evidence trails	Every label includes a reason string and decision trace, so security teams can audit why a package was flagged.
Graduated precision	Runs without a GitHub token (deps.dev only) and warns that results are less precise; a token adds commit history and repository state, including archive detection.
GitHub Actions supply chain scanning	CI/CD workflows depend on third-party Actions that are themselves OSS. uzomuzo extracts `uses:` directives, recursively resolves composite actions (including local `./` references), and evaluates each Action's lifecycle.

Sample Output — All lifecycle states (detailed format)

Active — `express` (193K dependents)

--- Summary Table ---
STATUS     PURL                    LIFECYCLE  BUILD
✅ ok       pkg:npm/[email protected]  Active     Hardened 9.3

── Summary ─────────────────────────────────────────────────
│ 1 dependencies | ✅ 1 ok | ⚠️ 0 caution | 🔴 0 replace | 🔍 0 review
└───────────────────────────────────────────────────────────

--- Detailed Report ---

--- PURL 1 ---
── pkg:npm/[email protected] ──────────────────────────────────
│ Fast, unopinionated, minimalist web framework for node.
│ ✅ Active: Actively maintained with recent releases
├─ Signals ─────────────────────────────────────────────────
│ Recent Stable Release: true
│ Last Human Commit: 2026-03-31
│ Maintained Score: 10/10
├─ Health ──────────────────────────────────────────────────
│ 68888 stars
│ Dependents: 861 direct, 2185 total (deps.dev, packages resolving to 4.18.2)
│ Depends on: 31 direct, 39 transitive
│ Scorecard Overall: 8.4/10  Maintained: 10.0/10
│ Last Commit: 2026-03-31
├─ Releases ────────────────────────────────────────────────
│ Stable: 5.2.1 (2025-12-01)
│ Pre-release: 5.0.0-beta.3 (2024-03-25)
│ Requested: 4.18.2 (2022-10-08)
├─ Build Integrity ─────────────────────────────────────────
│ ✅ Hardened 9.3/10 (5/6)
│ Dangerous Workflow  10  Branch Protection    —
│ Code Review          9  Token Permissions   10
│ Binary Artifacts    10  Pinned Deps          6
│ → https://scorecard.dev/viewer/?uri=github.com%2Fexpressjs%2Fexpress
├─ Links ───────────────────────────────────────────────────
│ Homepage: https://expressjs.com
│ Repository: https://github.com/expressjs/express
│ Registry: https://www.npmjs.com/package/express
│ deps.dev: https://deps.dev/npm/express
└───────────────────────────────────────────────────────────

Stalled — `moment` (2K+ dependents)

--- Summary Table ---
STATUS     PURL                   LIFECYCLE    BUILD
✅ ok       pkg:npm/[email protected]  Legacy-Safe  Moderate 4.7

── Summary ─────────────────────────────────────────────────
│ 1 dependencies | ✅ 1 ok | ⚠️ 0 caution | 🔴 0 replace | 🔍 0 review
└───────────────────────────────────────────────────────────

--- Detailed Report ---

--- PURL 1 ---
── pkg:npm/[email protected] ───────────────────────────────────
│ Parse, validate, manipulate, and display dates in
│   javascript.
│ ✅ Legacy-Safe: Dormant but no known vulnerabilities
├─ Signals ─────────────────────────────────────────────────
│ Last Human Commit: 2024-02-18
│ Advisories: 0
├─ Health ──────────────────────────────────────────────────
│ 48016 stars
│ Dependents: 933 direct, 2483 total (deps.dev, packages resolving to 2.29.4)
│ Scorecard Overall: 3.1/10  Maintained: 0.0/10
│ Last Commit: 2024-02-18
├─ Releases ────────────────────────────────────────────────
│ Stable: 2.30.1 (2023-12-27)
│ Requested: 2.29.4 (2022-07-06)
├─ Build Integrity ─────────────────────────────────────────
│ ⚠️ Moderate 4.7/10 (5/6)
│ Dangerous Workflow  10  Branch Protection    —
│ Code Review          0  Token Permissions    0
│ Binary Artifacts    10  Pinned Deps          0
│ → https://scorecard.dev/viewer/?uri=github.com%2Fmoment%2Fmoment
├─ Links ───────────────────────────────────────────────────
│ Homepage: momentjs.com
│ Repository: https://github.com/moment/moment
│ Registry: https://www.npmjs.com/package/moment
│ deps.dev: https://deps.dev/npm/moment
└───────────────────────────────────────────────────────────

Scorecard says Maintained 0.0 — but zero advisories and does one thing perfectly. Watch for maintenance decline.

Stalled — `gorilla/mux` (22K stars)

--- Summary Table ---
STATUS      PURL                                     LIFECYCLE  BUILD
⚠️ caution  pkg:golang/github.com/gorilla/[email protected]  Stalled    Moderate 6.5

── Summary ─────────────────────────────────────────────────
│ 1 dependencies | ✅ 0 ok | ⚠️ 1 caution | 🔴 0 replace | 🔍 0 review
└───────────────────────────────────────────────────────────

--- Detailed Report ---

--- PURL 1 ---
── pkg:golang/github.com/gorilla/[email protected] ─────────────────
│ Package gorilla/mux is a powerful HTTP router and URL
│   matcher for building Go web servers with 🦍
│ ⚠️ Stalled: Low maintenance
├─ Signals ─────────────────────────────────────────────────
│ Last Human Commit: 2024-06-19
│ Maintained Score: 0/10
├─ Health ──────────────────────────────────────────────────
│ 21814 stars
│ Scorecard Overall: 4.9/10  Maintained: 0.0/10
│ Last Commit: 2024-06-19
├─ Releases ────────────────────────────────────────────────
│ Stable: v1.8.1 (2023-10-18)
│ Highest (SemVer): v1.8.2-0.20240619235004-fe14465e5077 (2024-06-19)
├─ Build Integrity ─────────────────────────────────────────
│ ⚠️ Moderate 6.5/10 (5/6)
│ Dangerous Workflow  10  Branch Protection    —
│ Code Review          9  Token Permissions    0
│ Binary Artifacts    10  Pinned Deps          0
│ → https://scorecard.dev/viewer/?uri=github.com%2Fgorilla%2Fmux
├─ Links ───────────────────────────────────────────────────
│ Homepage: https://gorilla.github.io
│ Repository: https://github.com/gorilla/mux
│ Registry: https://pkg.go.dev/github.com%2Fgorilla%2Fmux
│ deps.dev: https://deps.dev/go/github.com/gorilla/mux
└───────────────────────────────────────────────────────────

No release since 2023, Maintained 0.0. Not dead, not active — clearly declining.

EOL-Effective — `dicer` (busboy → multer → express)

--- Summary Table ---
STATUS     PURL                 LIFECYCLE      BUILD
🔴 replace  pkg:npm/[email protected]  EOL-Effective  —

── Summary ─────────────────────────────────────────────────
│ 1 dependencies | ✅ 0 ok | ⚠️ 0 caution | 🔴 1 replace | 🔍 0 review
└───────────────────────────────────────────────────────────

--- Detailed Report ---

--- PURL 1 ---
── pkg:npm/[email protected] ─────────────────────────────────────
│ A very fast streaming multipart parser for node.js
│ 🔴 EOL-Effective: Unmaintained, unpatched vulnerabilities
├─ Signals ─────────────────────────────────────────────────
│ Last Human Commit: 2023-07-15
│ Maintained Score: 0/10
│ Advisories: 1
│ Max Advisory Severity: HIGH 7.5
├─ Health ──────────────────────────────────────────────────
│ 188 stars
│ Dependents: 51 direct, 1270 total (deps.dev, packages resolving to 0.3.1)
│ Depends on: 1 direct, 0 transitive
│ Scorecard Overall: 2.8/10  Maintained: 0.0/10
│ Last Commit: 2023-07-15
├─ Releases ────────────────────────────────────────────────
│ Stable: 0.3.1 (2021-12-19)  ⚠️ 1 advisory
│   HIGH     (7.5)  GHSA-wm7h-9275-46v2
│   → https://deps.dev/npm/dicer/0.3.1
├─ Links ───────────────────────────────────────────────────
│ Repository: https://github.com/mscdex/dicer
│ Registry: https://www.npmjs.com/package/dicer
│ deps.dev: https://deps.dev/npm/dicer
└───────────────────────────────────────────────────────────

No deprecation, no archive — but unpatched ReDoS + zero maintenance. SCA blind spot.

EOL-Effective — `xlsx` (SheetJS — popular, but frozen on npm)

--- Summary Table ---
STATUS     PURL                 LIFECYCLE      BUILD
🔴 replace  pkg:npm/[email protected]  EOL-Effective  —

── Summary ─────────────────────────────────────────────────
│ 1 dependencies | ✅ 0 ok | ⚠️ 0 caution | 🔴 1 replace | 🔍 0 review
└───────────────────────────────────────────────────────────

--- Detailed Report ---

--- PURL 1 ---
── pkg:npm/[email protected] ─────────────────────────────────────
│ 📗 SheetJS Spreadsheet Data Toolkit -- New home
│   https://git.sheetjs.com/SheetJS/sheetjs
│ 🔴 EOL-Effective: Unmaintained, unpatched vulnerabilities
├─ Signals ─────────────────────────────────────────────────
│ Last Human Commit: 2024-02-01
│ Maintained Score: 0/10
│ Advisories: 2
│ Max Advisory Severity: HIGH 7.8
├─ Health ──────────────────────────────────────────────────
│ 36278 stars
│ Dependents: 4048 direct, 5730 total (deps.dev, packages resolving to 0.18.5)
│ Depends on: 7 direct, 1 transitive
│ Scorecard Overall: 2.3/10  Maintained: 0.0/10
│ Last Commit: 2024-02-01
├─ Releases ────────────────────────────────────────────────
│ Stable: 0.18.5 (2022-03-24)  ⚠️ 2 advisories
│   HIGH     (7.8)  GHSA-4r6h-8v6p-xvw6
│   HIGH     (7.5)  GHSA-5pgg-2g8v-p4x9
│   → https://deps.dev/npm/xlsx/0.18.5
├─ Links ───────────────────────────────────────────────────
│ Homepage: https://sheetjs.com/
│ Repository: https://github.com/sheetjs/sheetjs
│ Registry: https://www.npmjs.com/package/xlsx
│ deps.dev: https://deps.dev/npm/xlsx
└───────────────────────────────────────────────────────────

Not deprecated, not archived — npm still resolves 0.18.5. But SheetJS stopped publishing to npm years ago (newer builds ship only from its own CDN), so the artifact your lockfile pins is frozen with the unpatched advisories shown above. Popular and healthy-looking, yet effectively end-of-life on npm — the textbook SCA blind spot.

Stalled — `dgrijalva/jwt-go` (archived & relocated, but no declared EOL)

--- Summary Table ---
STATUS     PURL                                          LIFECYCLE  BUILD
🔴 replace  pkg:golang/github.com/dgrijalva/[email protected]  Stalled    —

── Summary ─────────────────────────────────────────────────
│ 1 dependencies | ✅ 0 ok | ⚠️ 0 caution | 🔴 1 replace | 🔍 0 review
└───────────────────────────────────────────────────────────

--- Detailed Report ---

--- PURL 1 ---
── pkg:golang/github.com/dgrijalva/[email protected] ────────────
│ ARCHIVE - Golang implementation of JSON Web Tokens (JWT).
│   This project is now maintained at:
│ 🔴 Stalled: Repository archived/disabled but not declared
│            end-of-life
├─ Signals ─────────────────────────────────────────────────
│ Repo Archived: true
├─ Health ──────────────────────────────────────────────────
│ 📦 Archived
│ 10747 stars
│ Scorecard Overall: 2.8/10  Maintained: 0.0/10
│ Last Commit: 2021-08-02
├─ Releases ────────────────────────────────────────────────
│ Stable: v3.2.0+incompatible (2018-03-08)  ⚠️ 2 advisories
│   HIGH     (7.5)  GHSA-w73w-5m7g-f7qc
│                   GO-2020-0017
│   → https://deps.dev/go/github.com%2Fdgrijalva%2Fjwt-go/v3.2.0+incompatible
│ Highest (SemVer): v4.0.0-20210802184156-9742bd7fca1c+incompatible (2021-08-02)
├─ Links ───────────────────────────────────────────────────
│ Homepage: https://github.com/golang-jwt/jwt
│ Repository: https://github.com/dgrijalva/jwt-go
│ Registry: https://pkg.go.dev/github.com%2Fdgrijalva%2Fjwt-go
│ deps.dev: https://deps.dev/go/github.com%2Fdgrijalva%2Fjwt-go
└───────────────────────────────────────────────────────────

Archived, relocated to golang-jwt/jwt, two unpatched HIGH advisories — you might expect EOL-Confirmed. But Go has no registry-level deprecation signal, so uzomuzo will not mechanically declare end-of-life on the archive flag alone (ADR-0020): it reports Stalled and surfaces the archive, the advisories, and the successor for a policy/human layer to act on. Migrate to golang-jwt/jwt.

EOL-Confirmed — `request` (186K dependents, npm deprecated)

--- Summary Table ---
STATUS     PURL                    LIFECYCLE      BUILD
🔴 replace  pkg:npm/[email protected]  EOL-Confirmed  —

── Summary ─────────────────────────────────────────────────
│ 1 dependencies | ✅ 0 ok | ⚠️ 0 caution | 🔴 1 replace | 🔍 0 review
└───────────────────────────────────────────────────────────

--- Detailed Report ---

--- PURL 1 ---
── pkg:npm/[email protected] ──────────────────────────────────
│ 🏊🏾 Simplified HTTP request client.
│ 🔴 EOL-Confirmed: Deprecated in npm registry
├─ Signals ─────────────────────────────────────────────────
│ EOL Source: npmjs
├─ EOL ─────────────────────────────────────────────────────
│ Evidence (1):
│   [npmjs] Deprecated in npm registry (confidence 0.90)
│     ↳ https://registry.npmjs.org/request
├─ Health ──────────────────────────────────────────────────
│ 25577 stars
│ Dependents: 51145 direct, 185814 total (deps.dev, packages resolving to 2.88.2)
│ Depends on: 20 direct, 26 transitive
│ Scorecard Overall: 3.6/10  Maintained: 0.0/10
│ Last Commit: 2020-02-11
├─ Releases ────────────────────────────────────────────────
│ Stable: 2.88.2 (2020-02-11)  ⚠️ 1 advisory (+ 3 transitive) ⚠️ [DEPRECATED]
│   MEDIUM   (6.1)  GHSA-p8p7-x288-28g6
│   Transitive (via [email protected], [email protected], [email protected]):
│     MEDIUM   (6.5)  GHSA-72xf-g2v4-qvf3
│     LOW      (3.7)  GHSA-6rw7-vpxm-498p
│                     GHSA-fjxv-7rqg-78g4
│   → https://deps.dev/npm/request/2.88.2
├─ Links ───────────────────────────────────────────────────
│ Repository: https://github.com/request/request
│ Registry: https://www.npmjs.com/package/request
│ deps.dev: https://deps.dev/npm/request
└───────────────────────────────────────────────────────────

186K dependents. npm deprecated with deprecation message, 1 direct advisory + 3 transitive advisories from vulnerable sub-dependencies. Last release 2020. Migrate immediately.

Sample Output — Table format (mixed statuses)

$ uzomuzo scan pkg:npm/[email protected] pkg:npm/[email protected] \
    pkg:golang/github.com/gorilla/[email protected] pkg:npm/[email protected] \
    pkg:golang/github.com/dgrijalva/[email protected] pkg:npm/[email protected] \
    -f table

STATUS      PURL                                          LIFECYCLE      BUILD
✅ ok        pkg:npm/[email protected]                        Active         Hardened 9.3
✅ ok        pkg:npm/[email protected]                         Legacy-Safe    Moderate 4.7
⚠️ caution  pkg:golang/github.com/gorilla/[email protected]       Stalled        Moderate 6.5
🔴 replace   pkg:npm/[email protected]                           EOL-Effective  —
🔴 replace   pkg:golang/github.com/dgrijalva/[email protected]  Stalled        —
🔴 replace   pkg:npm/[email protected]                        EOL-Confirmed  —

── Summary ─────────────────────────────────────────────────
│ 6 dependencies | ✅ 2 ok | ⚠️ 1 caution | 🔴 3 replace | 🔍 0 review
└───────────────────────────────────────────────────────────

Sample Output — go.mod input

$ uzomuzo scan --file go.mod -f table

STATUS      PURL                                                        RELATION  LIFECYCLE      BUILD
🔴 replace   pkg:golang/github.com/dgrijalva/[email protected]+incompatible  direct    Stalled        —
⚠️ caution  pkg:golang/github.com/gorilla/[email protected]                    direct    Stalled        Moderate 6.5
✅ ok        pkg:golang/github.com/stretchr/[email protected]               direct    Active         Moderate 6.7

── Summary ─────────────────────────────────────────────────
│ 3 dependencies | ✅ 1 ok | ⚠️ 1 caution | 🔴 1 replace | 🔍 0 review
└───────────────────────────────────────────────────────────

go.mod input adds a RELATION column. Requirements marked // indirect are scanned only with --show-transitive and appear as transitive, with no parent shown, because go.mod does not record which direct dependency pulls them in.

Sample Output — GitHub Actions workflow input

$ uzomuzo scan --file .github/workflows/ci.yml -f detailed

── https://github.com/actions/checkout ─────────────────────
│ Description: Action for checking out a repo
│ ✅ Active
│ Reason: Recent human commits but no recent package publishing; maintenance score unavailable (Scorecard not found)
├─ Health ──────────────────────────────────────────────────
│ 7733 stars
│ Last Commit: 2026-01-09
├─ License ─────────────────────────────────────────────────
│ Project: MIT (github)
│ Requested Version: (none)
├─ Links ───────────────────────────────────────────────────
│ Homepage: https://github.com/features/actions
│ Repository: https://github.com/actions/checkout
└───────────────────────────────────────────────────────────

── https://github.com/actions/setup-go ─────────────────────
│ Package: pkg:golang/github.com/actions/[email protected]+incompatible
│ Description: Set up your GitHub Actions workflow with a specific version of Go
│ ✅ Active
│ Reason: Recent stable package version published with recent human commits; maintenance score ≥ 3
├─ Health ──────────────────────────────────────────────────
│ 1673 stars
│ Score: 6.1/10  Maintained: 10.0/10
│ Last Commit: 2026-03-17
├─ Releases ────────────────────────────────────────────────
│ Stable: v6.4.0+incompatible (2026-03-17)
├─ License ─────────────────────────────────────────────────
│ MIT (depsdev)
├─ Links ───────────────────────────────────────────────────
│ Repository: https://github.com/actions/setup-go
│ Registry: https://pkg.go.dev/github.com%2Factions%2Fsetup-go
│ deps.dev: https://deps.dev/go/github.com/actions/setup-go
└───────────────────────────────────────────────────────────

Workflow scan extracts uses: directives and evaluates each referenced Action as a GitHub repository.

Supported Ecosystems

npm / PyPI / Maven / Cargo / Go modules / NuGet / RubyGems / Packagist

Features

Multi-ecosystem support: 8 ecosystems with full PURL (Package URL) spec compliance
Build integrity grading: Supply chain build tamper resistance assessment using Scorecard checks and SLSA provenance — details
OpenSSF Scorecard integration: Automated security maturity metrics
Parallel-optimized batch processing: 5,000+ PURLs/run with concurrent API orchestration
Unified scan subcommand: Single entry point for PURL, GitHub URL, SBOM, go.mod — with --fail-on CI exit code gating
Flexible input: Direct PURL / GitHub URL / file list / mixed / stdin pipe
CSV / CLI reports: Comprehensive output of metrics, licenses, and lifecycle status
Extensible via AnalysisEnricher hook: Inject custom EOL catalog logic without modifying core — details
Embeddable as a Go library: pkg/uzomuzo/ facade for SaaS integration — details
Claude Code skills: LLM-powered analysis prompts for EOL risk assessment and dependency removal prioritization — details
Automated monthly scanning: GitHub Actions workflow with Trivy SBOM generation and GitHub Issue publication, with Slack notifications available via GitHub issue subscriptions/integrations — details

Architecture

Interfaces → Application → Domain ← Infrastructure

Domain: Pure business logic — lifecycle decision tree, ecosystem models, entity definitions (no external dependencies)
Application: Use case orchestration with AnalysisEnricher hook pattern for pluggable EOL catalogs
Infrastructure: External APIs (deps.dev, GitHub GraphQL, Scorecard) / parallel processing / I/O
Interfaces: CLI entry points / input validation (no concurrent logic)

See Data Flow for API integration diagram and two-path assessment architecture.

Documentation

Document	Overview
Usage	CLI commands, batch processing, filters, configuration, logging
Build Integrity	Supply chain build tamper resistance grading
Data Flow	API integration diagram, two-path assessment architecture
Integration Examples	Trivy/SBOM integration, container scanning, dependency tracing, GitHub Actions scheduled scanning
Landscape Comparison	Problem space, tool comparison, complementary usage
Library Usage	Go library API, Evaluator, Analysis type
PURL Identity Model	OriginalPURL / EffectivePURL / CanonicalKey 3-layer design
License Resolution	ResolvedLicense / normalization / fallback / promotion
Development Guide	SPDX updates, testing, performance, troubleshooting
Claude Code Skills	LLM-powered dependency analysis: EOL risk tracing + 6-axis removal evaluation
VulnCon 2026 Slides	FIRST VulnCon 2026 presentation: "The CVE Blind Spot"

Why "Uzomuzo"?

Pronounced oo-zoh-moo-zoh — from the Japanese uzōmuzō (有象無象).

In Buddhist philosophy, uzō (有象) means "things with form" and muzō (無象) means "things without form." Together, uzōmuzō originally described "all things in the universe — the visible and the invisible."

Modern software supply chains are exactly that: a vast universe of seen (direct) and unseen (transitive) dependencies. uzomuzo illuminates this complexity — mapping every element of your dependency tree to bring clarity to the chaos.

About

Developed by kotakanbe, creator of Vuls — an open-source vulnerability scanner with 12,000+ GitHub stars. uzomuzo extends this mission from reactive vulnerability scanning to proactive supply chain lifecycle governance.

Sponsor

If you find uzomuzo useful, consider sponsoring the maintainer.

License

Apache License 2.0 — see LICENSE for details.