Autonomous remediation · npm ecosystem

UC Berkeley MICS Capstone · Summer 2026

A hundred eyes. Three lenses.
One verdict.

Knows when to merge. Knows when not to.

Arguss scans your dependency tree, scores every upgrade across vulnerability, maintainer trust, and pipeline safety, and opens pull requests only for the ones it's confident won't break anything.

Scan a repo → Try axios demo

Projects tracked

Critical findings

KEV-flagged

Auto-fix ready

113

axios

283 findings 2 of 283 reach production

46 auto-fix 37 review

node-cross-spawn

158 findings 0 of 158 reach production

27 auto-fix 33 review

express

12 findings 0 of 12 reach production

4 review

node-fetch

20 findings 0 of 20 reach production

4 auto-fix 8 review

node-semver

17 findings 0 of 17 reach production

8 auto-fix 1 review

webpack

4 findings 0 of 4 reach production

2 auto-fix

eslint

43 findings 0 of 43 reach production

4 auto-fix 7 review

commander.js

1 findings 0 of 1 reach production

1 auto-fix

dotenv

128 findings 0 of 128 reach production

13 auto-fix 8 review

minimist

49 findings 0 of 49 reach production

16 review

chalk

40 findings 0 of 40 reach production

KEV 1 auto-fix 2 review

prettier

1 findings 1 of 1 reach production

1 review

lodash

231 findings 0 of 231 reach production

KEV 60 review

TypeScript

14 findings 0 of 14 reach production

7 auto-fix 1 review

Securing repos across teams at

By the numbers

Security you can measure

Real outcomes from teams running Arguss in their CI/CD pipelines.

CVE detection rate across tested lockfiles

0 lenses

Vulnerability · Trust · Pipeline | all must agree

Findings analyzed in the axios v1.0.0 demo scan

Cost to scan your first repo | free forever

Features

Three lenses. One verdict.

Every proposed fix runs through independent checks before Arguss decides to merge, flag, or decline.

Deep dependency scanning

Arguss traces every transitive dependency in your package-lock.json and maps it against NVD, OSV, and GitHub Advisory in real time.

CVSS score, EPSS probability, and KEV flag per finding
Nested transitive deps, not just direct dependencies
Fix-version ranges with patch-only and minor upgrade options
npm-ecosystem-aware: handles hoisting, deduplication, workspaces

CRITICAL

semver 5.7.1

CVE-2022-25883 - ReDoS via untrusted version string

9.8

HIGH

axios 0.21.1

CVE-2021-3749 - Server-side request forgery via redirect

7.5

MEDIUM

node-fetch 2.6.5

CVE-2022-0235 - Exposure of sensitive information via redirect

5.4

AUTO-MERGE

minimist 1.2.5 → 1.2.8

All 3 lenses passed. Arguss opens a PR for review; it does not merge on GitHub.

✓

Maintainer trust scoring

Dependabot merges any version bump. Arguss checks whether the publisher behind it can be trusted, catching supply-chain attacks that have no CVE yet.

npm publisher reputation via package metadata
OpenSSF Scorecard signals: signed releases, CI, code review
Recent maintainer account changes flagged automatically
Typosquat and dependency confusion heuristics

package event-stream 3.3.6

publisher dominictarr → right9ctrl ⚠

maintainer_age 2 days old

scorecard 2.1 / 10 | no signed releases

verdict TRUST VETO → decline

────────────────────────────

package lodash 4.17.20 → 4.17.21

publisher jdalton | 10y tenure

scorecard 8.4 / 10 | passes

verdict TRUST PASS → continue

CI workflow safety via zizmor

A version bump that introduces a vulnerable GitHub Actions workflow is not a safe bump. Arguss checks the CI configuration before any merge.

zizmor static analysis on all .github/workflows files
Detects script injection, excessive permissions, unpinned actions
Pipeline veto blocks the merge even if vuln + trust pass
Veto reason surfaced in the fix-confidence card for review

# .github/workflows/ci.yml (post-upgrade)

- name: Build and test

run: echo ${{ github.event.pull_request.title }}

↳ zizmor: script-injection (HIGH) - untrusted input in run step

- uses: actions/checkout@main

↳ zizmor: unpinned-uses (MEDIUM) - use SHA pin instead

pipeline verdict: VETO - 1 HIGH finding

Shareable risk reports

Every scan produces a live, shareable results page; no PDF exports, no stale screenshots. Link stakeholders to the dashboard directly.

Fix-confidence verdict per package: auto_merge · review · decline
Executive summary from scan signals
KEV, EPSS, and CVSS all surfaced per finding
Glossary, lens breakdowns, and a chat panel built in

Risk Score Improved from C last week · 3 critical resolved

2Critical

5High

11Medium

Two ways in

Scan

Point Arguss at a public GitHub repo URL. Review fix-confidence results and select candidates to action.

Scan a repo →

Upload

Upload package-lock.json and optional workflow artifacts for offline analysis.

Upload files →

What makes Arguss different

vs. Snyk

We don't just find. We fix.

Detection-only tools stop at the alert. Arguss proposes version bumps and can open PRs when confidence is high.

vs. Dependabot

We don't auto-merge what we can't verify.

Blind version bumps ignore trust and pipeline risk. Arguss gates action on three independent lenses.

vs. Manual review

Humans focus on cases that need a human.

At scale, triaging hundreds of advisories per repo is unsustainable. Arguss automates the safe path.

Scan your first repo in 30 seconds

No credit card. No CLI to install. Just paste a GitHub URL and go.

Scan →

Or try the demo: axios v1.0.0 → 178 findings

A hundred eyes. Three lenses. One verdict.

Open-source ecosystem health