CRA SBOM Audit

Lockfile or SBOM in, CRA evidence pack out: OSV flaws, fixes, licence risk and Annex I mapping.

Who it's for

CTOs, engineering leads and compliance owners at software and connected-device makers who sell into the EU and need to show their dependency tree is under control before the Cyber Resilience Act applies in full on 11 December 2027 (Article 14 reporting already applies since 11 September 2026).

What you get

Paste a package-lock.json, yarn.lock, pnpm-lock.yaml, uv.lock, poetry.lock, pinned requirements.txt, or a CycloneDX or SPDX JSON SBOM. You get an evidence pack, not a certificate:

• Every unique component checked against the OSV vulnerability database, results paged to the end, with the query time and the newest advisory date as a snapshot.
• One finding per distinct flaw (CVE and GHSA aliases merged), CVSS v3 score computed from the published vector, and the smallest fixed version above yours or "no fix published".
• VEX-style triage: affected, or proposed not affected for dev-only packages (you confirm).
• Licences read from your file or the npm and PyPI registries and classified for copyleft or restricted terms. Ambiguous or missing ones are flagged unresolved, never guessed.
• A remediation plan (fix now, schedule, no fix, licence review) and a mapping to CRA Annex I and Article 14 where each requirement is evidence provided, action needed or not assessed.
• Coverage counts: received, duplicates merged, answered, skipped, anything not fully read.

Example

A lockfile with lodash 4.17.11 returns the critical prototype pollution advisory with CVSS 9.1 and the fix in 4.17.12, listed under fix now.

Limits

Process duties (disclosure policy, update distribution, Article 14 reporting) cannot be shown by an inventory and are marked not assessed. Exploitation status is not checked. Not legal advice. Up to 2,000 unique components; yarn berry, Pipfile.lock and XML SBOMs are refused for free.

How to use

• Run it in Apify Console or through the API: choose what to do, fill in the fields for that tool and start. The result is one item in the run's dataset.
• From an AI assistant through Apify's MCP server (mcp.apify.com), which finds and runs this Actor with the same fields. What each choice does:
  • cra_requirements: List the Cyber Resilience Act requirements this evidence pack maps to (Annex I Part I and II, Article 14) with their application dates, which of them an inventory can evidence and which are process duties it cannot show, plus the accepted input formats and licence classes.
  • audit_inventory: Audit a dependency lockfile or SBOM: every unique component is checked against the OSV vulnerability database (batch query, paged to the end), flaws are deduplicated by alias, scored from the published CVSS v3 vector, matched to the smallest fixed version, and triaged (affected, or proposed not affected for dev-only).

Pricing

• CRA evidence pack for one lockfile or SBOM: $1.76
• Component assessed (first 1,000): $0.006
• Component assessed (1,001 to 2,000): $0.003

Failed calls are never charged.