rubion - Security scanner for Ruby gems and NPM packages. F

项目说明

Rubion

Rubion is a security and scanner for Ruby and Ja projects. It helps you identify and outdated dependencies in your Ruby gems and NPM/Ja packages.

<img width="1237" height="671" alt="Screenshot 2025-11-14 at 10 48 12 am" src=" />

Features

Installation

Install from RubyGems

Install from source

Usage

Basic Scan

Na to your project directory and run:

This will scan your project for:

Scan Options

Sorting Options

A columns for sorting:

Filtering Options

Direct dependencies are automatically highlighted in bold text in the output.

Mode

View Help

Check

Output Example

Complete Scan Output

Direct Dependencies Only (with --exclude-dependencies)

When using rubion scan --exclude-dependencies, only direct dependencies are shown:

Note: Direct dependencies (from Gemfile or package.json) are displayed in bold text in the tables. In the example above, rails, sidekiq, and pg are direct dependencies from the Gemfile.

Requirements

Note: If both npm and yarn are a, Rubion will prompt you to choose which one to use. You can respond with 'y' for yarn or 'n' for npm.

Installing bundler-audit (recommended)

Note: Without bundler-audit, gem scanning will be skipped.

How It Works

Rubion uses a modular architecture:

1. Scanner (lib/rubion/scanner.rb): Executes commands to scan for and outdated
- bundle-audit check for gem
- bundle outdated --parseable for gem
- npm audit --json or yarn audit --json for package (auto-detects which is a)
- npm outdated --json or yarn outdated for package (auto-detects which is a)
- Fetches release dates and data from RubyGems.org and NPM registry APIs
- Uses parallel processing (10 concurrent threads) for fast API calls
- Prompts user to choose between npm and yarn if both are a
- Parses Gemfile and package.json to identify direct dependencies

2. Reporter (lib/rubion/reporter.rb): Formats scan results into beautiful terminal tables using terminal-table
- Adds se icons (🔴 🟠 🟡 🟢 ⚪)
- Formats dates, time differences, and counts
- Supports incremental output (gems first, then packages)
- Highlights direct dependencies in bold text
- Supports sorting by any column with indicators (↑/↓)
- Filters results based on --exclude-dependencies flag

3. CLI (lib/rubion.rb): Provides the command-line interface
- Parses command-line options (--gems-only, --packages-only, --sort-by, --asc, --desc, --exclude-dependencies)
- Coordinates scanning and reporting

For detailed information about data collection and mapping, see HOW_IT_WORKS.md.

Performance

Rubion is optimized for speed:

Typical scan times:

De

After checking out the repo, run bin/setup to install dependencies. Then, run rake spec to run the tests. You can also run bin/console for an interacti.

Running tests

Running RuboCop

Building the gem

Installing locally

Extending Rubion

Rubion is designed to be easily extensible. To add new scanners:

1. Add a new method in lib/rubion/scanner.rb
2. Add a corresponding report method in lib/rubion/reporter.rb
3. Update the scan flow in Scanner#scan

Example:

Contributing

Bug reports and pull requests are welcome on GitHub at

1. Fork it
2. Create your feature branch (git checkout -b feature/my-new-feature)
3. Commit your changes (git commit -am 'Add some feature')
4. Push to the branch (git push origin feature/my-new-feature)
5. Create new Pull Request

License

The gem is a as open source under the terms of the MIT License.

Support

If you have any questions or need help, please:

Roadmap

Future features planned:

Acknowledgments

项目信息

开发语言：Ruby

Star 数：13

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Security scanner for Ruby gems and NPM packages. Finds vulnerabilities and outdated dependencies with release dates, version analysis, and severity indicators.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。