A Node.js CLI that scans a project’s lockfile (npm / pnpm / yarn) to find known vulnerabilities using the OSV.dev API.
- Detects package manager by lockfile:
- npm:
package-lock.json - pnpm:
pnpm-lock.yaml - yarn:
yarn.lock
- npm:
- Reads exact installed versions from the lockfile
- Queries OSV (
https://api.osv.dev/v1/query) per dependency - Colored, human-readable table output (chalk + cli-table3)
- Spinner while scanning (ora)
- Optional
--jsonoutput for automation - Includes fix version when OSV provides one
npx vuln-scanpnpm dlx vuln-scannpm i -g vuln-scan
vuln-scanThis package also exposes vuln-scan-cli as an alias:
npx vuln-scan -- --json
npx vuln-scan-cli
vuln-scan-cli --jsonvuln-scan
vuln-scan --json- Requires Node.js
>= 18(uses built-infetch). - Scans both dependencies and devDependencies as recorded in the lockfile.
pnpm install
node ./cli.js
node ./cli.js --jsonSee SECURITY.md for vulnerability reporting and PGP details.