[Tool] fad-checker – Air-gapped, multi-ecosystem dependency auditor…

Hi !

After years of doing code audits, existing SCA tools were just frying my brain with their need for a full build environment, their struggles with big multi-module Maven projects, and those messy, monstrous polyglot monorepos.

So I wrote fad-checker a dependency auditor designed specifically for real-world professional code audits:

• One-shot scan of multiples Maven / Gradle / npm / PHP / PyPI / NuGet / Go / Ruby projects
• + vendored JS, committed binaries, certificates & private keys
• No build tools, no Docker, no package manager
• True air-gapped mode
• Private/internal package detection
• CVE prioritization (KEV → EPSS → CVSS) + EOL + licenses
• The HTML report that code auditors dream of, with one-click “Copy for Word” on charts, summary & tables
• Word / CycloneDX / SARIF / JSON outputs + CI bindings / outputs
• Cross-platform standalone binaries

Battle tested and compared to leading (partial) alternatives

Repo : https://github.com/9pings/fad-checker

Looking for feedback (and criticism) from people who actually do source code audits.

Impact

fad-checker itself is a security tool that helps identify vulnerabilities, deprecated dependencies, private/internal packages, and cryptographic risks in source code repositories. It does not introduce a vulnerability or threat but rather mitigates risk by improving visibility and prioritization of security issues in dependencies and committed artifacts. There is no indication of any security flaw or exploit associated with fad-checker.

Defensive guidance

No remediation or patching is required as fad-checker is a security auditing tool, not a vulnerability. Users should consider adopting it to improve dependency auditing and supply chain risk management in air-gapped or complex environments.

Summary

fad-checker is an air-gapped, multi-ecosystem dependency auditor that scans various package ecosystems and committed artifacts without requiring build environments or network connectivity. It reads manifests and lockfiles directly from disk, supports multiple output formats including HTML and Word, and prioritizes CVEs using CISA KEV, EPSS, and CVSS scores. The tool also detects private/internal packages, deprecated or abandoned dependencies, and cryptographic material such as certificates and keys. It is designed for real-world professional code audits, enabling one-shot scans of large polyglot monorepos and producing audit-grade reports with provenance and delta comparisons.

[Tool] fad-checker – Air-gapped, multi-ecosystem dependency auditor made for real code audits (NO Maven required)

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 23 Sep 2026, 07:17 UTC

Technical details

References

Community reviews