Six places a dependency comes from
Every package carries where it was found: declared in a manifest, discovered installed, pulled in by a pipeline. When those disagree, the disagreement is the finding.
Manifests and lockfiles across every supported ecosystem. A lockfile gives exact versions rather than ranges.
The package tree on disk, so a package that is installed but not declared is reported as exactly that.
Install commands in CI configuration, because tooling installed by the pipeline is part of the build.
Shell, Makefile and task recipes, where a bare install line has no manifest anywhere near it.
Base images, Compose services, Kubernetes workloads, Helm charts and the package database inside an image.
Go build info, Rust cargo auditable data and JVM coordinates recovered from artefacts that ship with no manifest.
Beyond "is the package installed?"
A vulnerable package you never call is a different problem from one your request handler calls on every request. Vulnetix parses source with tree-sitter and looks for the specific symbols the advisory is about, using queries served per vulnerability rather than a generic guess. Direct means the symbol is used inside the vulnerable package's own installed directory. Transitive means the rest of the project is swept for callers. Turning the analysis off also skips the query fetch, so an air-gapped run does not pay for it. Reachability analysis is available on Pro plans and above.
Seven ways to fail a build, and none of them are on by default
Gate on severity, on known exploitation, on malicious packages, on end of life, on unpinned dependencies, on how many major versions behind a dependency is, and on how young a release is. Combine the ones that match your risk appetite. An organisation policy can raise them for everyone, and when it does the organisation value wins even over an explicit flag.
One round trip, one document
Parsing happens locally. Package names and versions go out, and a CycloneDX document comes back enriched with advisories, exploit intelligence, end of life records and remediation advice. Existing findings and VEX statements in the document are carried forward rather than overwritten.
The same package list feeds licence compliance and malware scanning. Packages inside an image are found by container scanning, and the fixes are applied by safe patching.