threatpulse 0.2.0

Scan your dependencies for weaponized vulnerabilities. Powered by ThreatPulse x402.

ThreatPulse CLI

Scan your dependencies for weaponized vulnerabilities. Powered by threatpulse.waltsoft.net.

Install

pip install threatpulse

Authentication

ThreatPulse offers 10 free lookups/day. For unlimited access, purchase an API key at threatpulse.waltsoft.net.

# Set once (recommended)
export THREATPULSE_KEY=tp_live_your_key_here

# Or pass per-command
threatpulse scan --key tp_live_your_key_here

Lost your key? Recover it at https://threatpulse.waltsoft.net/key/recover with your purchase email.

Check balance:

curl -H "Authorization: Bearer tp_live_..." https://threatpulse.waltsoft.net/key/balance

Usage

# Scan a lockfile
threatpulse scan --file package-lock.json

# Fail CI if urgency >= 80
threatpulse scan --threshold 80

# JSON output for piping
threatpulse scan --format json | jq '.[] | select(.urgency_score > 70)'

# SARIF for GitHub Code Scanning
threatpulse scan --format sarif > results.sarif

What makes this different

Unlike Trivy/Snyk/Inspector, ThreatPulse tells you if a CVE is actively weaponized:

🔴 CVE-2024-45257   HIGH       weaponized   95   metasploit:exploit/unix/webapp/byob_unauth_rce
🟡 CVE-2025-1234    MEDIUM     poc          45   github.com/user/CVE-2025-1234
🟢 CVE-2025-5678    LOW        none         12   no known exploit

Supported lockfiles

• package-lock.json (npm)
• requirements.txt (pip)
• Cargo.lock (Rust)
• go.sum (Go)
• Gemfile.lock (Ruby)

GitHub Action

- uses: awsdataarchitect/threatpulse-action@v1
  with:
    fail-on-urgency: 80

Links

• API: https://threatpulse.waltsoft.net
• GitHub: https://github.com/awsdataarchitect/threatpulse-cli