Reachble: Open‑Source VEX Generation for npm Projects via Import‑Graph Reachability

The author introduces Reachble, an open‑source tool that automatically generates VEX (Vulnerability Exploitability eXchange) documents for npm projects by analyzing import graphs. Reachble parses lockfiles, pulls CVE data from OSV.dev, NVD, and GHSA, and extracts affected functions to determine if vulnerable code is reachable from user‑controlled input. It outputs CycloneDX VEX and OpenVEX files that can be CI‑gated and shipped alongside SBOMs, eliminating manual spreadsheets. The tool classifies findings into four verdict tiers—CRITICAL, HIGH, LOW, and SAFE—based on whether the code is reachable from unauthenticated, authenticated, or internal paths. In a real‑world test on three Express apps, Reachble reduced noise by 69% to 85% by marking 40–74 CVEs as SAFE. The article compares Reachble to traditional SCA, OSV‑Scanner, and Endor Labs, highlighting its unique function‑level reachability and full VEX generation. The author demonstrates a sample run with lodash 4.17.18, showing SAFE and LOW verdicts and the resulting JSON VEX output. Reachble is built with @typescript-eslint/parser for import graph construction and plans to use ts‑morph for full function‑level call graphs in future releases. The tool addresses the gap created by SBOM mandates that require VEX, providing an auditable, machine‑readable justification for each CVE. The article encourages teams to integrate Reachble into their CI pipelines to reduce false positives and improve security posture.