Reference

SCA and reachability

Atmos matches every installed package version against the advisory database, then checks whether your code can reach each vulnerable package.

Ecosystems and lockfiles#

Nine lockfile formats across three ecosystems: npm (package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock), Maven (pom.xml, Gradle lockfiles) and NuGet (packages.config, packages.lock.json, *.deps.json).

Advisory resolution#

Advisories resolve against a local copy of the OSV database in .atmos/osv-db/. --online queries the live OSV API instead and --offline keeps resolution on the local copy. Both flags are in the CLI reference. On the platform, findings with a CVE are enriched with EPSS scores.

The reachability ladder#

Every dependency finding sits on an evidence ladder, and each tier implies the ones before it. Atmos analyzes your source and assigns the highest tier the evidence supports.

Each tier needs more evidence than the one below it.

Verdict	Meaning
present	The package is in your resolved dependency tree.
imported	Your code imports the vulnerable package.
calls-symbol	Your code calls the affected function the advisory names. Confidence is highest for npm and lower for Maven and NuGet.
exploitable	Untrusted input reaches the vulnerable call. The top of the ladder.
unknown	Atmos could not decide. The finding stays in the report with this verdict.

Moving up a tier requires positive evidence, and when the analysis cannot be sure, Atmos lowers the finding's confidence. Use --reachable-only to drop findings that stay at the present tier and --min-confidence to filter by evidence strength.