Yarn CycloneDX Integration Guide

Integrate the CycloneDX Yarn plugin with Vulnetix. Generate a CycloneDX SBOM from your Yarn Berry workspace, then upload to Vulnetix for JavaScript supply-chain analysis.

Install & scan

$ # Zero-install via yarn dlx (Yarn Berry v3/v4)
yarn dlx -q @cyclonedx/yarn-plugin-cyclonedx --help

# Or install the plugin permanently
yarn plugin import https://github.com/CycloneDX/cyclonedx-node-yarn/releases/latest/download/yarn-plugin-cyclonedx.cjs
$ yarn dlx -q @cyclonedx/yarn-plugin-cyclonedx --output-format JSON --output-file bom.json

Run Yarn CycloneDX in CI

Scan on every push and upload the report as a workflow artifact:

- name: Enable Corepack
  run: corepack enable

- name: Install dependencies
  run: yarn install --immutable

- name: Generate CycloneDX SBOM
  run: yarn dlx -q @cyclonedx/yarn-plugin-cyclonedx --omit dev --output-format JSON --output-file bom.json

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: yarn-cyclonedx
    path: bom.json
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Yarn CycloneDX's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Yarn CycloneDX. Keep running it. Vulnetix sits on top of Yarn CycloneDX (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Yarn CycloneDX is strongest at its core category and also carries features in SCA, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Yarn CycloneDX does well

• Purpose-built for Yarn Berry (v3/v4) resolution, producing accurate SBOMs where npm-focused tools miss Plug'n'Play / non-node_modules layouts
• Emits standards-compliant CycloneDX 1.2 through 1.7 in JSON or XML, with a selectable spec version
• Recursively resolves workspace dependencies and distinguishes production vs development components
• Reproducible-output option for deterministic, diffable SBOMs in CI attestation pipelines

Where Vulnetix adds to it: The Yarn plugin builds an accurate CycloneDX inventory but stops there, no vuln matching, VEX, or prioritisation. Vulnetix ingests its SBOM (and authors its own CycloneDX 1.7 + SPDX 2.3), then adds SCA vuln matching, exploit-intel prioritisation, reachability, immutable versioned VEX, and cross-scanner dedup across the whole toolchain. It consumes this SBOM as an input, complementing Yarn-native generation.

No migration, no rip-and-replace. Yarn CycloneDX keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Yarn CycloneDX results in Vulnetix

Upload Yarn CycloneDX CycloneDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Yarn CycloneDX documentation ↗  ·  Source repository ↗

Wire Yarn CycloneDX into your CI/CD pipeline →