{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security/3"},{"label":"Quality Assurance","url":"https://skillfed.io/packages/category/software-development-quality-assurance/4"}],"enrichment":{"capability":"ca9 analyzes Python package supply chains to determine whether flagged CVEs are actually reachable from your application code, combining static import tracing, dependency inventory, and optional runtime coverage to separate actionable vulnerabilities from unreachable alerts.","skillfed_tags":["supply-chain-security","cve-triage","reachability-analysis"],"use_cases":["Filter CVE alerts from SCA tools to identify which vulnerabilities actually affect your code, reducing alert fatigue.","Build a normalized package inventory from mixed lockfile formats to audit direct and transitive dependencies.","Enforce supply-chain policy in CI by blocking untrusted registries, dependency-confusion risks, or missing hashes.","Combine static import analysis with coverage data to confirm whether a vulnerable function is ever called.","Generate OpenVEX or SARIF reports for downstream security tools, enriching SCA output with reachability evidence."],"what_it_does":"ca9 is a local-first supply-chain defense tool that reads your Python project's manifests, lockfiles, and SCA reports, then answers a single critical question for each CVE alert: is this vulnerable code actually reachable from your application? It combines three evidence sources\u2014static AST import tracing, dependency graph analysis, and optional runtime coverage data\u2014to classify each vulnerability as reachable, unreachable (static or dynamic), or inconclusive, with an evidence trail and confidence score for each verdict.\n\nInstead of patching every flagged CVE, you get a filtered list of only the vulnerabilities that matter: code your app actually imports and executes. ca9 also provides broader supply-chain vetting (malware advisories, registry trust, artifact hashes, license policy, dependency confusion risk) and runtime preflight enforcement via `ca9 run`, so you can block unsafe packages before they install. It reads native Python manifests, npm lockfiles, and SBOM inputs, and outputs JSON, SARIF, OpenVEX, or Markdown for integration into CI gates and audit workflows.","worth_installing":"Yes, if you use Python and want to reduce CVE alert noise with evidence-backed triage. ca9 is actively maintained, has no known vulnerabilities, low install friction, and solves a real problem\u2014most flagged CVEs are unreachable. The MPL-2.0 license is permissive for local use. Start with `ca9 scan` on an existing SCA report to see the impact. Early-stage (Alpha), so expect API evolution, but the core reachability logic is sound."},"id":"ca9","links":{"html":"https://skillfed.io/packages/ca9","md":"https://skillfed.io/packages/ca9.md","pypi":"https://pypi.org/project/ca9/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-06-27","license_spdx":"MPL-2.0","license_treatment":"copyleft","name":"ca9","python_support":"supports_current","summary":"Open source Python package security and evidence-backed SCA triage"},"popularity":{"monthly_downloads":77301,"position":14537,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"0.5.0"}