CVE Lite CLI

Vulnerability scanning that starts in your terminal and fits cleanly into CI. Scan your lockfile, get copy-and-run fix commands, and ship clean code.

Scan. Understand. Fix.

🏆 Featured on GitHub Open Source Friday · Ranked #5 in Help Net Security's 20 open-source security tools · OpenSSF Best Practices

Covered by The Register · CSO Online · SecurityWeek · SD Times · DevOps.com · ReversingLabs

Running in CI at SolidJS , the Government of British Columbia as a required merge gate, French government digital services ( DINUM ) , and Valibot . In production use in France, Canada, Germany, Thailand and China.

⚡ One command. No account, no API key, nothing leaves your machine. npx cve-lite-cli . → Quick Start

Quick Start • Usage • Screenshots • HTML Report • Compare • Roadmap • Contributing • Join Slack

Or one-off with npx :

No account. No configuration. No source code leaves your machine.

Note: CVE Lite CLI includes better-sqlite3 , a native SQLite binding used for the local advisory database . During installation, npm may download a prebuilt binary or compile one from source. This can produce extra console output — it is expected and is not CVE Lite CLI itself running an install script. See Dependency footprint for details.

Note: CVE Lite CLI includes better-sqlite3 , a native SQLite binding used for the local advisory database . During installation, npm may download a prebuilt binary or compile one from source. This can produce extra console output — it is expected and is not CVE Lite CLI itself running an install script. See Dependency footprint for details.

For the full flag reference and exit codes see the CLI Reference guide and Fix mode guide .

Override hygiene ( overrides )

overrides and resolutions are powerful, but they rot. CVE Lite CLI audits them across npm, pnpm, yarn, and bun, catching thirteen classes of problem:

Use the overrides subcommand for a hygiene-only run (no CVE scan, faster, fully offline-capable) with auto-fix support. Use --check-overrides to append hygiene results to a regular CVE scan in one pass.

For the full guide with per-rule examples and CI patterns, see the Override Hygiene Auditing guide .

Maintenance risk ( --check-maintenance )

A CVE scanner tells you a transitive package is vulnerable. It does not tell you why you can't fix it - often a direct dependency of yours pins it below the fix, and clearing it needs a breaking major upgrade the scanner never mentions. The DM001 rule surfaces exactly that, plus direct dependencies npm has marked deprecated.

Packages that have not published in years get a Last release context line; release age is informational, not a severity signal on its own.

For the full guide, see the Maintenance Risk Detection guide .

Release cooldown awareness

Package managers added a release cooldown to skip the danger window right after a version is published, when a hijacked release is live but not yet caught (the chalk / debug compromise sat live for two hours). CVE Lite CLI reads the cooldown your project already configures and warns when a recommended fix is newer than that window, so it never quietly pushes you onto a version your own package manager would refuse to install.

The warning is advisory and on by default (no flag, no exit-code change). It reads min-release-age (npm), minimumReleaseAge (pnpm), or npmMinimalAgeGate (Yarn); it never invents a window.

For the full guide, see the Release Cooldown Awareness guide .

Most security tooling is built around pipelines, not developers. Dependabot opens PRs you'll get to eventually. CI scanners block merges after the fact. Dashboards surface lists of CVE IDs with no clear path to fixing them. Developers learn to ignore it.

CVE Lite CLI is built for the moment before you push. It reads your lockfile locally, queries OSV and the npm registry advisory API, and produces copy-and-run npm install , pnpm add , yarn add , or bun add commands — not a list of identifiers. You see which packages are direct versus transitive, get parent-aware upgrade guidance, and can scan offline in restricted environments.

The closer a security tool is to a developer's natural workflow, the more likely it is to be used.

No other free tool combines all of the following: lockfile scanning across npm, pnpm, Yarn, and Bun; parent-aware transitive remediation that tells you which package to upgrade (not just which one is vulnerable); fix version validation before suggesting an upgrade; a fully offline advisory DB for restricted environments; CVE + license compliance scanning in a single pass; SBOM output in both CycloneDX and SPDX with the vulnerability findings attached rather than as a separate inventory step; and an EPSS priority signal that combines CVSS severity with exploitation likelihood into four actionable tiers.

✅ = built-in strength · ⚠️ = partial or workflow-dependent · ❌ = not a core strength

The transitive parent guidance is a key difference: CVE Lite CLI avoids recommending direct installs for packages that are only present transitively. For npm lockfiles, it can identify when npm update is enough to re-resolve a known non-vulnerable child within the current parent range, and when the parent package itself needs an upgrade.

For detailed per-tool analysis, see Comparison with other tools .

Replace Dependabot with one batched PR

CVE Lite CLI v1.26.0 ships a GitHub Action fix mode that runs on a schedule and opens a single batched pull request with all validated dependency upgrades - advisory IDs, before/after finding counts, and OSV-confirmed fix versions included.

Add this file to your repo:

Full Action documentation -> - for scan-only CI gating see the CI and Workflow Integration guide .

Real-world validation

CVE Lite CLI has been evaluated against real open-source projects to verify that it surfaces meaningful issues - including non-obvious transitive vulnerabilities and complex upgrade paths - not just low-signal advisory matches.

OWASP Juice Shop - scanning a deliberately vulnerable application with known dependency issues

NestJS - working through a real transitive dependency remediation sequence across a widely-used Node.js framework

Visual Studio Code - two direct Anthropic SDK advisories and a high-severity gulp toolchain chain in the VS Code root lockfile

Gatsby - Yarn Classic monorepo with 128 findings, five direct CVEs, and CVE Lite vs yarn audit deduplication

Analog - modern pnpm Angular monorepo with unexpected toolchain vulnerabilities

20+ case studies across npm, pnpm, Yarn, and Bun projects ->

In-repo lockfile fixtures for most projects live under examples/ - clone and scan immediately without downloading full upstream checkouts.

These are not demos. They are documented scans against real codebases with real findings, recorded before and after applying fix commands.

If you maintain an open-source JavaScript or TypeScript project and want CVE Lite CLI evaluated on it, open an issue and the repository.

Sniff out stale AI override advice with this open source CLI - The Register (Thomas Claburn, Senior Reporter), June 2026

Shift left: How CVE Lite CLI is transforming developer security - SD Times (David Rubinstein, Editor-in-Chief), June 2026

As AI speeds coding, CVE Lite CLI keeps security deliberately AI-free - CSO Online (Shweta Sharma), May 2026

CVE Lite CLI: Open-source dependency vulnerability scanner - Help Net Security, May 2026

Full press coverage ->

OWASP (Open Web Application Security Project) is the globally recognized nonprofit behind the security standards followed by millions of developers worldwide - most notably the OWASP Top 10 , the most widely cited web application security reference in the industry. Organizations from startups to Fortune 500 companies use OWASP guidelines as the foundation of their security programs.

CVE Lite CLI is an OWASP Lab Project - reviewed and accepted by the OWASP community as a vendor-neutral, open source security tool.

Where it fits in the OWASP ecosystem:

CVE Lite CLI fills a specific gap - fast, local-first JS/TS dependency scanning close to release time - that broader OWASP tools are not optimized for:

CVE Lite CLI complements these tools. It is not a replacement for continuous monitoring or full SBOM management - it is the fast local check you run before pushing.

Community and adoption

CVE Lite CLI is used in production across organizations and independent developers in multiple countries. Confirmed users span government digital services, enterprise engineering platforms, open-source libraries, and security education.

Notable adopters include:

SolidJS - the framework's creator, Ryan Carniato, added CVE Lite CLI directly to its CI, scanning every change with results reported to GitHub Code Scanning

DINUM (France) - integrated across four French government digital service repositories, including official AI training infrastructure for civil servants

DGAFP (France) - Ministry for Civil Service, used as a pre-commit hook on a public-sector HR chatbot

Government of British Columbia (Canada) - running as a required merge gate alongside Trivy at the Ministry of Citizens' Services

Valibot and Formisch - integrated as a GitHub Action and dev script with branch protection

does not detect malicious packages before they appear in advisory data

does not perform behavioral malware detection or package content analysis

does not prove exploitability or verify runtime reachability

does not scan container images, binaries, secrets, or IaC

does not replace a full application security program

currently focused on JS/TS dependency scanning

local advisory sync performance will need continued optimization as the advisory dataset grows

Runtime: yaml · yarn-lockfile · better-sqlite3 · fflate · semver

Dev only: @types/node · tsx · typescript

This is intentional. Because CVE Lite CLI is a security-oriented tool, runtime dependencies are kept minimal and reviewable.

Native dependency: better-sqlite3

better-sqlite3 is a native Node.js addon that provides the SQLite binding for CVE Lite CLI's local advisory database. This database powers offline scanning ( --offline , --offline-db ), advisory sync ( cve-lite advisories sync ), and air-gapped workflows ( cve-lite advisories init ).

Because it includes compiled C/C++ code, npm must run an install script when installing better-sqlite3 . During installation:

Prebuilt binary available: prebuild-install downloads a prebuilt binary for your platform — fast, though npm may still print a deprecation warning for prebuild-install itself ( #519 ).

No prebuilt available: the package falls back to compiling from source using node-gyp , which requires a C/C++ toolchain and produces more console output.

This install step belongs to better-sqlite3 , not to CVE Lite CLI — the project itself does not define any preinstall , install , or postinstall hooks.

npm install-script permissions: Depending on your npm version and configuration, npm may prompt you to approve the install script before it runs. This is an npm security feature. Online scanning works even when the install script is blocked — the native binding is loaded lazily and only used by --offline , --offline-db , cve-lite advisories sync , and cve-lite advisories init . If you use any of those features, the better-sqlite3 install script must be allowed to complete.

npx behavior: When using npx cve-lite-cli , a quiet run does not necessarily mean the install script was skipped. If npm's cache already contains the required prebuilt binary, installation is silent. On a cold cache, the same native install step runs.

Troubleshooting guide - no lockfile found, zero results, slow advisory sync, offline DB errors, --fix skipping findings, CI failures

Parser Coverage guide - supported lockfile formats, selection priority, package.json fallback, monorepos, private registries

Remediation Strategy guide - how CVE Lite CLI chooses upgrade targets and parent update paths

Release Cooldown Awareness guide - how CVE Lite CLI reads your package manager's cooldown and warns on fix versions newer than the window you trust

SPDX SBOM guide - SPDX 2.3 output, how findings are attached, NTIA minimum elements, and inventory-only mode

CycloneDX SBOM guide - CycloneDX 1.6 output and Dependency-Track integration

Security and verification

Every release is signed - GPG-signed git tags for source, Sigstore Artifact Attestations for the release tarball, and ECDSA signatures via the npm registry. Verify with:

For full details, fingerprints, and the project's threat model, see SECURITY.md and the Security Assurance Case .

For governance details - roles, decision-making, and dispute resolution - see CONTRIBUTING.md .

Feedback on output clarity, remediation guidance, ecosystem coverage, and CI usage is especially valuable.

See CONTRIBUTING.md to get started.

Add a badge to your project

If you use CVE Lite CLI in your project, add this badge to your README:

Community and support

For bug reports and feature requests: GitHub Issues

Helpful feedback includes reproducible bug reports, real-world lockfile edge cases, ideas for clearer output and remediation guidance, and CI or JSON workflow examples.

Using CVE Lite CLI at your company or in your projects? your use case in the community thread .

For security-related reporting: SECURITY.md

This project follows a Code of Conduct . Please review it before participating.

If CVE Lite CLI helps your release workflow, a GitHub star helps more developers find it.

Thanks to everyone who helps improve CVE Lite CLI - issues, pull requests, documentation, case studies, and real-world lockfile feedback all count.

Avatar grid generated from the GitHub contributors graph via contrib.rocks .

New here? See CONTRIBUTING.md to get started, and review the Code of Conduct before participating.

Thank you to those who sponsor CVE Lite CLI and help keep it maintained:

Maintainer note: CVE Lite CLI is an OWASP Lab Project maintained by Sonu Kapoor . The goal is to build a tool the security and developer community trusts and returns to - not a product that requires vendor lock-in or a dashboard to be useful. If you find a real-world lockfile edge case, a remediation gap, or a workflow that doesn't fit, open an issue. Real-world feedback from real projects is the most valuable input this project gets. See CONTRIBUTING.md for how to get involved.

MIT - built in public and maintained as an OWASP Foundation Project by Sonu Kapoor.