OWASPSecurity & privacy
CVE Lite CLI
A local-first JavaScript/TypeScript lockfile vulnerability scanner focused on actionable remediation, with CI, SARIF, HTML reports, and offline advisory data.
- Security
- Frontend
- Backend
- DevOps
- Code quality
- Testing
- CLI
- Windows
- macOS
- Linux
- Runs locally
- Popularity
- 669 Stars
- GitHub stars
- Recent activity
- 8/17/2026
- Updated in the last 30 days
- License
- MIT
- Permissive
Why it matters
We look beyond stars: what problem it solves, whether it creates real utility, and what makes its approach worth noticing.
Problem
Many dependency scanners tell developers where a CVE exists but leave them to determine direct versus transitive dependencies, safe upgrade versions, and parent dependency paths, creating alerts without fast remediation.
Practical value
It starts from local lockfile scanning and produces actionable fix commands, parent-aware transitive guidance, CI exit codes, SARIF, HTML reports, and offline advisory data—closer to the developer’s actual remediation step.
Innovation / differentiation
It shifts the focus from finding more vulnerabilities to fixing them correctly, adding override/resolution hygiene and maintenance-risk signals that explain what blocks a CVE fix—a distinct angle from list-oriented scanners.
Leverage potential
It works both locally and in CI through JSON/SARIF, failure thresholds, and GitHub Actions, allowing the same remediation logic to cover pre-push checks and continuous integration.
Why now
AI-assisted development increases the pace of both code and dependency changes, making low-friction security tooling that lives near the developer workflow and produces concrete fixes more valuable.
Key highlights
- Scans npm, pnpm, Yarn, and Bun lockfiles against OSV advisory data
- Distinguishes direct and transitive dependencies with parent-aware remediation guidance
- JSON, SARIF, and HTML reports plus severity-based exit codes
Quick start
How it is installed, how hard it is, and where to start.
Where it runs
Runs locally
Difficulty
Easy — follow the steps
- 01Install
cve-lite-cliglobally with npm or run it once withnpxagainst a test repository. - 02Start with default or verbose output to understand direct/transitive paths, then add JSON, SARIF, or HTML reporting as needed.
- 03When using
--fix, work on a separate branch and review tests/diffs before merging; restricted environments can sync the advisory database for offline scans.
Best for
- Developers who want to try it on their machine
More about it
CVE Lite CLI is an OWASP Lab Project focused on lockfiles from npm, pnpm, Yarn, and Bun projects. It correlates OSV advisories with the dependency tree and emphasizes which direct dependency should be upgraded when a vulnerable package is only transitive, producing package-manager-specific remediation commands instead of only listing CVE or GHSA identifiers. Output modes include JSON, SARIF, and interactive HTML reports, with severity-based exit codes, a GitHub Action, and a local advisory database for restricted or offline environments. It also audits stale overrides/resolutions and maintenance risks that can block a CVE fix. The README clearly states its limits: it does not perform malicious-package behavior analysis, scan containers/binaries/secrets/IaC, or prove runtime exploitability, so it belongs in a dependency-security workflow rather than replacing a broader application-security program.
Sources
Each field shows its status and source — expand to review.
12 · Expand
Sources
Each field shows its status and source — expand to review.
capability tags
Verifiedsecurity, code_quality, testing
Source: admin_cms · cms editor · 8/17/2026
Latest release
Verifiedv1.29.0
Source: GitHub API · latest_release=v1.29.0 · 8/17/2026
License
VerifiedMIT
Source: GitHub API · license.spdx_id=MIT · 8/17/2026
needs api key
VerifiedNo
Source: admin_cms · cms editor · 8/17/2026
One-liner
Verified{"en":"A local-first JavaScript/TypeScript lockfile vulnerability scanner focused on actionable remediation, with CI, SARIF, HTML reports, and offline advisory data.","zh":"面向 JavaScript/TypeScript lockfile 的本地依赖漏洞扫描 CLI，重点给出可执行修复路径，并支持 CI、SARIF、HTML 报告和离线 advisory 数据库。"}
Source: admin_cms · cms editor · 8/17/2026
Platforms
Verifiedwindows, macos, linux
Source: admin_cms · cms editor · 8/17/2026
Category hint
Inferred from materialsai-apps
Source: Project README · hint=ai-apps · 8/17/2026
product forms
Verifiedcli
Source: admin_cms · cms editor · 8/17/2026
role tags
Verifiedsecurity, frontend, backend, devops
Source: admin_cms · cms editor · 8/17/2026
supports docker
VerifiedNo
Source: admin_cms · cms editor · 8/17/2026
supports local
VerifiedYes
Source: admin_cms · cms editor · 8/17/2026
supports self host
VerifiedNo
Source: admin_cms · cms editor · 8/17/2026
Related projects
Other verified projects matched by category, capabilities, and intended roles.
openbao
An open-source secrets management system for storing, distributing, rotating, and controlling access to secrets, certificates, and keys.
agent-governance-toolkit
A governance toolkit for AI agents that adds policy checks, identity, audit trails, sandboxing, and SRE controls across multiple agent frameworks.
fleet
A device-management platform for IT and security teams covering MDM, software deployment, patching, inventory queries, and compliance across desktop and mobile operating systems.
VirusDetector
A Manifest V3 Chrome/Edge extension that detects Silver Fox Trojan phishing and spoofed websites using multi-rule scoring and download blocking.
Cline
An open-source coding agent for IDEs and terminals that can inspect projects, edit files, run commands, and gate actions through approval controls.
Flawless
An enterprise Agentic SRE platform for Kubernetes and cloud infrastructure that automates fault discovery, evidence gathering, diagnosis, controlled execution, and recovery verification.