Getting started with Verimu

Verimu ships as a single npm package. You can run it instantly with npx — no installation required:

npx verimu

Or install it globally if you prefer:

npm install -g verimu

Requires Node.js 20+. Ships with full TypeScript types. Dual ESM/CJS — works with both import and require.

Navigate to any project that has a lockfile and run verimu. It auto-detects your ecosystem, parses the lockfile, generates a CycloneDX SBOM, and checks all dependencies for known CVEs:

cd your-project
npx verimu

You'll see output like this:

  ╦  ╦┌─┐┬─┐┬┌┬┐┬ ┬
  ╚╗╔╝├┤ ├┬┘│││││ │
   ╚╝ └─┘┴└─┴┴ ┴└─┘
  CRA Compliance Scanner vX.Y.Z
  Scanning /home/user/my-app...
  No VERIMU_API_KEY set — running in offline mode
  Get your API key at https://app.verimu.com/dashboard/api-keys

┌─────────────────────────────────────────────┐
│          VERIMU CRA COMPLIANCE SCAN         │
└─────────────────────────────────────────────┘

  Project:      /home/user/my-app
  Ecosystem:    npm
  Dependencies: 247
  Scanned at:   2026-02-13T10:30:00.000Z

  ✓ SBOM generated (cyclonedx-json, 1.7)
    Components: 247

  ⚠ 3 vulnerabilities found:

    [CRIT]  CVE-2024-4068
           braces@3.0.2 → fix: 3.0.3
           Uncontrolled resource consumption

    [HIGH]  CVE-2024-28849
           follow-redirects@1.15.4 → fix: 1.15.6
           Sensitive data exposure via Authorization header

    [MED]   CVE-2024-29041
           express@4.18.2 → fix: 4.19.2
           Open redirect via URL parsing

  Sources queried: osv (420ms)

  ─── Summary ───
  Total: 3  |  Critical: 1  |  High: 1  |  Medium: 1  |  Low: 0

  Thanks for using Verimu — keeping your software CRA-compliant 🛡️

Verimu writes the SBOM to ./sbom.cdx.json by default. This is your CRA-compliant software bill of materials — a machine-readable inventory of every dependency in your project, ready for regulatory audits.

To unlock continuous monitoring, automated vulnerability alerts, and CRA reporting workflows, create a free account on the Verimu platform:

When you register, Verimu automatically generates a Default API key for you. You'll see it once — copy it immediately and store it securely (e.g., in your CI/CD secrets).

All data is stored on EU infrastructure. Verimu is built and hosted in Europe for companies that need data residency compliance.

Set the VERIMU_API_KEY environment variable and run the scan again. Verimu will automatically create your project on the platform and upload the results:

export VERIMU_API_KEY=vmu_your_key_here
npx verimu

With an API key, you'll see the upload step in the output:

  API key detected — results will sync to Verimu platform

  ...scan output...

  Syncing to Verimu platform...
  ✓ Project created: my-app
  ✓ 247 dependencies tracked
  ⚠ 3 vulnerable dependencies flagged
  ✓ Dashboard: https://app.verimu.com/dashboard/projects/abc123

Projects are created automatically on first scan — you never need to set anything up in the dashboard manually. On subsequent runs, Verimu updates the existing project with the latest SBOM and dependency data.

This is where Verimu becomes your automated compliance engine. Add a single step to your CI pipeline so every push is scanned, SBOMs are kept up to date, and your team is alerted the moment a new CVE affects your dependencies.

Select your platform and ecosystem to get a ready-to-use config file:

name: Verimu CRA Scan
on:
  push:
    branches: [main]
  pull_request:

jobs:
  verimu:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
      - name: Run Verimu scan
        env:
          VERIMU_API_KEY: ${{ secrets.VERIMU_API_KEY }}
        run: |
          # Ensure package-lock.json is committed.
          npx verimu scan --fail-on HIGH

Once your pipeline is running, everything flows into your Verimu dashboard at app.verimu.com. For each project you can see: