diff --git a/vulncheck/fetch.go b/vulncheck/fetch.go
index d028513..b065fe7 100644
--- a/vulncheck/fetch.go
+++ b/vulncheck/fetch.go
@@ -97,7 +97,14 @@
 	return mv, nil
 }
 
+// fetchingInTesting is a flag used to avoid skipping
+// loading local vulnerabilities in testing.
+var fetchingInTesting bool = false
+
 func isLocal(mod *packages.Module) bool {
+	if fetchingInTesting {
+		return false
+	}
 	modDir := mod.Dir
 	if mod.Replace != nil {
 		modDir = mod.Replace.Dir
diff --git a/vulncheck/helpers_test.go b/vulncheck/helpers_test.go
index 95eaa24..8aa6d18 100644
--- a/vulncheck/helpers_test.go
+++ b/vulncheck/helpers_test.go
@@ -7,6 +7,8 @@
 import (
 	"fmt"
 
+	"golang.org/x/tools/go/packages"
+	"golang.org/x/tools/go/packages/packagestest"
 	"golang.org/x/vulndb/osv"
 )
 
@@ -22,6 +24,34 @@
 	return nil, nil
 }
 
+// testClient contains the following test vulnerabilities
+//   golang.org/amod/avuln.{VulnData.Vuln1, vulnData.Vuln2}
+//   golang.org/bmod/bvuln.{Vuln}
+var testClient = &mockClient{
+	ret: map[string][]*osv.Entry{
+		"golang.org/amod": []*osv.Entry{
+			{
+				ID: "VA",
+				Affected: []osv.Affected{{
+					Package:           osv.Package{Name: "golang.org/amod/avuln"},
+					Ranges:            osv.Affects{{Type: osv.TypeSemver, Events: []osv.RangeEvent{{Introduced: "1.0.0"}, {Fixed: "1.0.4"}, {Introduced: "1.1.2"}}}},
+					EcosystemSpecific: osv.EcosystemSpecific{Symbols: []string{"VulnData.Vuln1", "VulnData.Vuln2"}},
+				}},
+			},
+		},
+		"golang.org/bmod": []*osv.Entry{
+			{
+				ID: "VB",
+				Affected: []osv.Affected{{
+					Package:           osv.Package{Name: "golang.org/bmod/bvuln"},
+					Ranges:            osv.Affects{{Type: osv.TypeSemver}},
+					EcosystemSpecific: osv.EcosystemSpecific{Symbols: []string{"Vuln"}},
+				}},
+			},
+		},
+	},
+}
+
 func moduleVulnerabilitiesToString(mv moduleVulnerabilities) string {
 	var s string
 	for _, m := range mv {
@@ -40,3 +70,21 @@
 	}
 	return s
 }
+
+func impGraphToStrMap(ig *ImportGraph) map[string][]string {
+	m := make(map[string][]string)
+	for _, n := range ig.Packages {
+		for _, predId := range n.ImportedBy {
+			pred := ig.Packages[predId]
+			m[pred.Path] = append(m[pred.Path], n.Path)
+		}
+	}
+	return m
+}
+
+func loadPackages(e *packagestest.Exported, patterns ...string) ([]*packages.Package, error) {
+	e.Config.Mode |= packages.NeedModule | packages.NeedName | packages.NeedFiles |
+		packages.NeedCompiledGoFiles | packages.NeedImports | packages.NeedTypes |
+		packages.NeedTypesSizes | packages.NeedSyntax | packages.NeedTypesInfo | packages.NeedDeps
+	return packages.Load(e.Config, patterns...)
+}
diff --git a/vulncheck/source.go b/vulncheck/source.go
new file mode 100644
index 0000000..46eab37
--- /dev/null
+++ b/vulncheck/source.go
@@ -0,0 +1,123 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package vulncheck
+
+import (
+	"golang.org/x/tools/go/packages"
+)
+
+// Source detects vulnerabilities in pkgs and computes slices of
+//  - imports graph related to an import of a package with some
+//    known vulnerabilities
+//  - requires graph related to a require of a module with a
+//    package that has some known vulnerabilities
+//  - call graph leading to the use of a known vulnerable function
+//    or method
+func Source(pkgs []*packages.Package, cfg *Config) (*Result, error) {
+	if !cfg.ImportsOnly {
+		panic("call graph feature is currently unsupported")
+	}
+
+	modVulns, err := fetchVulnerabilities(cfg.Client, extractModules(pkgs))
+	if err != nil {
+		return nil, err
+	}
+
+	result := &Result{
+		Imports:  &ImportGraph{Packages: make(map[int]*PkgNode)},
+		Requires: &RequireGraph{Modules: make(map[int]*ModNode)},
+	}
+	vulnPkgImportSlice(pkgs, modVulns, result)
+	// TODO(zpavlinovic): compute module and call graph slice.
+	return result, nil
+}
+
+// pkgId is an id counter for nodes of Imports graph.
+var pkgID int = 0
+
+func nextPkgID() int {
+	pkgID += 1
+	return pkgID
+}
+
+// vulnPkgImportSlice computes the slice of pkg imports graph leading to imports of vulnerable
+// packages in modVulns and stores the slice to result.
+func vulnPkgImportSlice(pkgs []*packages.Package, modVulns moduleVulnerabilities, result *Result) {
+	// analyzed contains information on packages analyzed thus far.
+	// If a package is mapped to nil, this means it has been visited
+	// but it does not lead to a vulnerable imports. Otherwise, a
+	// visited package is mapped to Imports package node.
+	analyzed := make(map[*packages.Package]*PkgNode)
+	for _, pkg := range pkgs {
+		// Top level packages that lead to vulnerable imports are
+		// stored as result.Imports graph entry points.
+		if e := vulnImportSlice(pkg, modVulns, result, analyzed); e != nil {
+			result.Imports.Entries = append(result.Imports.Entries, e)
+		}
+	}
+}
+
+// vulnImportSlice checks if pkg has some vulnerabilities or transitively imports
+// a package with known vulnerabilities. If that is the case, populates result.Imports
+// graph with this reachability information and returns the result.Imports package
+// node for pkg. Otherwise, returns nil.
+func vulnImportSlice(pkg *packages.Package, modVulns moduleVulnerabilities, result *Result, analyzed map[*packages.Package]*PkgNode) *PkgNode {
+	if pn, ok := analyzed[pkg]; ok {
+		return pn
+	}
+	analyzed[pkg] = nil
+	// Recursively compute which direct dependencies lead to an import of
+	// a vulnerable package and remember the nodes of such dependencies.
+	var onSlice []*PkgNode
+	for _, imp := range pkg.Imports {
+		if impNode := vulnImportSlice(imp, modVulns, result, analyzed); impNode != nil {
+			onSlice = append(onSlice, impNode)
+		}
+	}
+
+	// Check if pkg has known vulnerabilities.
+	vulns := modVulns.VulnsForPackage(pkg.PkgPath)
+
+	// If pkg is not vulnerable nor it transitively leads
+	// to vulnerabilities, jump out.
+	if len(onSlice) == 0 && len(vulns) == 0 {
+		return nil
+	}
+
+	// Module id gets populated later.
+	pkgNode := &PkgNode{
+		Name: pkg.Name,
+		Path: pkg.PkgPath,
+	}
+	analyzed[pkg] = pkgNode
+
+	id := nextPkgID()
+	result.Imports.Packages[id] = pkgNode
+
+	// Save node predecessor information.
+	for _, impSliceNode := range onSlice {
+		impSliceNode.ImportedBy = append(impSliceNode.ImportedBy, id)
+	}
+
+	// Create Vuln entry for each symbol of known OSV entries for pkg.
+	for _, osv := range vulns {
+		for _, affected := range osv.Affected {
+			if affected.Package.Name != pkgNode.Path {
+				continue
+			}
+			for _, symbol := range affected.EcosystemSpecific.Symbols {
+				vuln := &Vuln{
+					OSV:        osv,
+					Symbol:     symbol,
+					PkgPath:    pkgNode.Path,
+					ModPath:    modPath(pkg.Module),
+					ImportSink: id,
+				}
+				result.Vulns = append(result.Vulns, vuln)
+			}
+		}
+	}
+	return pkgNode
+}
diff --git a/vulncheck/source_test.go b/vulncheck/source_test.go
new file mode 100644
index 0000000..ef8a850
--- /dev/null
+++ b/vulncheck/source_test.go
@@ -0,0 +1,148 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package vulncheck
+
+import (
+	"path"
+	"reflect"
+	"testing"
+
+	"golang.org/x/tools/go/packages/packagestest"
+)
+
+// TestImportsOnly checks for module and imports graph correctness
+// for the Config.ImportsOnly=true mode. The inlined test code has
+// the following package (left) and module (right) imports graphs:
+//
+//       entry/x        entry/y                     entry
+//              \     /        \                   /     \
+//            amod/avuln      zmod/z           amod       zmod
+//                |                              |
+//              wmod/w                         wmod
+//                |                              |
+//            bmod/bvuln                       bmod
+//
+// Packages ending in "vuln" have some known vulnerabilities.
+func TestImportsOnly(t *testing.T) {
+	e := packagestest.Export(t, packagestest.Modules, []packagestest.Module{
+		{
+			Name: "golang.org/entry",
+			Files: map[string]interface{}{
+				"x/x.go": `
+			package x
+
+			import "golang.org/amod/avuln"
+
+			func X() {
+				avuln.VulnData{}.Vuln1()
+			}
+			`,
+				"y/y.go": `
+			package y
+
+			import (
+				"golang.org/amod/avuln"
+				"golang.org/zmod/z"
+			)
+
+			func Y() {
+				avuln.VulnData{}.Vuln2()
+				z.Z()
+			}
+		`}},
+		{
+			Name: "golang.org/zmod@v0.0.0",
+			Files: map[string]interface{}{"z/z.go": `
+			package z
+
+			func Z() {}
+			`},
+		},
+		{
+			Name: "golang.org/amod@v1.1.3",
+			Files: map[string]interface{}{"avuln/avuln.go": `
+			package avuln
+
+			import "golang.org/wmod/w"
+
+			type VulnData struct {}
+			func (v VulnData) Vuln1() { w.W() }
+			func (v VulnData) Vuln2() {}
+			`},
+		},
+		{
+			Name: "golang.org/bmod@v0.5.0",
+			Files: map[string]interface{}{"bvuln/bvuln.go": `
+			package bvuln
+
+			func Vuln() {}
+			`},
+		},
+		{
+			Name: "golang.org/wmod@v0.0.0",
+			Files: map[string]interface{}{"w/w.go": `
+			package w
+
+			import "golang.org/bmod/bvuln"
+
+			func W() { bvuln.Vuln() }
+			`},
+		},
+	})
+	defer e.Cleanup()
+
+	// Make sure local vulns can be loaded.
+	fetchingInTesting = true
+	// Load x and y as entry packages.
+	pkgs, err := loadPackages(e, path.Join(e.Temp(), "entry/x"), path.Join(e.Temp(), "entry/y"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(pkgs) != 2 {
+		t.Fatal("failed to load x and y test packages")
+	}
+
+	cfg := &Config{
+		Client:      testClient,
+		ImportsOnly: true,
+	}
+	result, err := Source(pkgs, cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// TODO(zpavlinovic): add test below for module graph too.
+
+	// Check that we find the right number of vulnerabilities.
+	// There should be three entries as there are three vulnerable
+	// symbols in the two import-reachable OSVs.
+	if len(result.Vulns) != 3 {
+		t.Errorf("want 3 Vulns, got %d", len(result.Vulns))
+	}
+
+	// Check that vulnerabilities are connected to the imports graph.
+	for _, v := range result.Vulns {
+		if v.ImportSink == 0 {
+			t.Errorf("want ImportSink !=0 for vuln %v:%v; got 0", v.Symbol, v.PkgPath)
+		}
+	}
+
+	// The slice should include import chains:
+	//   x -> avuln -> w -> bvuln
+	//         |
+	//   y ---->
+	// That is, z package shoud not appear in the slice.
+	wantImports := map[string][]string{
+		"golang.org/entry/x":    {"golang.org/amod/avuln"},
+		"golang.org/entry/y":    {"golang.org/amod/avuln"},
+		"golang.org/amod/avuln": {"golang.org/wmod/w"},
+		"golang.org/wmod/w":     {"golang.org/bmod/bvuln"},
+	}
+
+	if igStrMap := impGraphToStrMap(result.Imports); !reflect.DeepEqual(wantImports, igStrMap) {
+		t.Errorf("want %v imports graph; got %v", wantImports, igStrMap)
+	}
+}