killer 1.3.0

A Rust security platform: static analysis, the .klr test language, a parallel test framework, project intelligence, code review, and a CI gate.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

# Dependency intelligence


`killer dependencies` analyzes your project's declared dependencies across
ecosystems — entirely from local manifest files. Nothing is fetched, and there
is **no vulnerability database**: it answers the questions your own files can
answer.

## Usage


```sh
killer dependencies            # summary + warnings
killer dependencies --details  # full per-dependency table
killer dependencies --json     # machine-readable, for CI
```

## Supported manifests


| Ecosystem | Manifest |
| --------- | -------- |
| Rust (Cargo) | `Cargo.toml` |
| Node (npm) | `package.json` |
| Python (PyPI) | `requirements.txt` |
| Go (modules) | `go.mod` |
| Java (Maven) | `pom.xml` |
| C# (NuGet) | `*.csproj` |

For each dependency Killer records its **name**, **version** (where the manifest
declares one), **ecosystem**, whether it is a **development** or **production**
dependency, and — where detectable — whether it appears to be **used**.

## What it reports


- **Ecosystem counts** — how many packages come from each manifest.
- **Production vs development** split.
- **Duplicate versions** — the same package pinned to more than one version
  (common in monorepos).
- **Possibly unused** — a dependency that is declared but never imported.

## Example


```
KILLER DEPENDENCY ANALYSIS

Ecosystems
  Node (npm)     86 packages
  Rust (Cargo)   42 packages

Production:   104
Development:  24
Total:        128

Warnings
  ⚠ lodash  possibly unused
  ⚠ react   duplicate versions: 18.2.0, 18.3.1
```

## Honest limits


- **No CVE / advisory data.** Killer does not ship a vulnerability database, so
  it does not claim a package is "vulnerable", "malicious", or "typosquatting".
  Those need a dataset that a local, zero-dependency tool cannot carry.
- **"Possibly unused" is a heuristic.** It matches your imports to declared
  package names (with hyphen/underscore normalization, plus an inline
  `crate::path` scan for Rust). It is reliable for Cargo, npm, PyPI, and Go;
  for Maven and NuGet, usage is reported as *unknown* rather than guessed,
  because import forms there do not track package names. Treat the list as a
  prompt to review, not a verdict.