cve-lite-cli is an OWASP Lab Project that scans npm, pnpm, Yarn and Bun lockfiles locally and emits copy-and-run fix commands for authorized defenders and developers.
| Tool | OWASP/cve-lite-cli — TypeScript dependency vulnerability scanner with remediation-first output for JS/TS projects |
| Category | Software Composition Analysis (SCA) / dependency vulnerability scanning |
| Primary Use | Scanning package-lock.json-style lockfiles locally, producing validated fix commands, SARIF, JSON, SPDX/CycloneDX SBOMs and HTML reports in CI pipelines |
| Safe Use | Entirely defensive: designed for developers and authorized security teams hardening their own codebases and CI; nothing leaves the machine |
| Telemetry Note | Fully local: no account, no API key, no source code or dependency tree egress; optional advisories sync fetches an advisory database, and --check-network rules explicitly touch the registry |
Most dependency scanners are good at producing a wall of CVE identifiers and terrible at telling you what to do next. cve-lite-cli, published by OWASP as the package cve-lite-cli on npm and promoted to an OWASP Lab Project, inverts that bargain: its tagline is that most tools tell you what is wrong while CVE Lite CLI tells you what to run. The scanner parses your lockfile in the JavaScript/TypeScript ecosystem — supporting npm, pnpm, Yarn and Bun — and pairs each finding with a copy-and-run fix command, parent-aware guidance for transitive issues, and severity-gated exit codes that make it practical as a CI merge gate.
Architecturally the most interesting claim in the README is the privacy posture: no account, no configuration, no API key, and nothing — neither your code nor your dependency tree — leaves your machine. The advisory intelligence is backed by a local SQLite database via the better-sqlite3 native binding, which the README explicitly flags because the prebuilt-binary download or source compilation during install can look noisy in CI logs. That transparency note is a good sign of a project that understands operator paranoia: it preemptively explains a native-module install step that might otherwise be mistaken for an install script doing something suspicious. A separate advisories init subcommand even lets you create an empty advisory database and populate it yourself, and --offline runs a scan with zero runtime API calls — a meaningful capability for air-gapped or policy-restricted environments.
Invocation is deliberately minimal. The one-liner npx cve-lite-cli . runs a scan against the current directory, or you can install globally with npm install -g cve-lite-cli and call cve-lite /path/to/project. From there the flag surface is dense but coherent: --verbose expands the fix plan with full dependency paths, --fix applies validated direct fixes and rescans, and --fail-on high sets a non-zero exit threshold so the tool can block merges. Output formats cover the usual CI integrations — --json for tooling, --sarif for GitHub Code Scanning, --sbom spdx or --sbom cyclonedx for SPDX 2.3 and CycloneDX SBOM generation, and --report for an interactive HTML dashboard, with --output directing files into a reports directory.
The feature that elevates this above a thin OSV wrapper is the override hygiene engine. Anyone who has maintained a large node_modules tree knows that overrides and resolutions blocks in package.json start as precise surgical pins and slowly rot into archaeological sediment. CVE Lite CLI audits these across all four supported package managers with thirteen named rules: OA001 catches orphaned overrides for packages no longer in the tree, OA002 flags pins on moving tags like latest or next, OA004 detects pins the rest of the tree has already surpassed, OA007 and OA010 compare pins against registry drift and known-vulnerable floors when run with --check-network, and PD001/PD002 surface phantom dependencies — packages imported in source that exist only via an override pin or as transitive deps. The overrides subcommand runs hygiene-only, fully offline, with --fix auto-remediation where safe.
Equally pragmatic is --check-maintenance, which addresses a gap every SCA user eventually hits: the scanner tells you a transitive package is vulnerable but not why you cannot fix it. The DM001 rule surfaces constraint drag — cases where one of your direct dependencies pins the vulnerable transitive below its fixed version, meaning the real remediation path is a breaking major upgrade the CVE report never mentions — and flags direct dependencies npm itself has deprecated, where no fix is coming through a routine update. Stale packages get a Last release context line, though the README is careful to note release age is informational rather than a severity signal on its own. This is the kind of honest epistemic framing you want in a tool making upgrade recommendations.
Perhaps the most quietly sophisticated feature is release cooldown awareness, and the README justifies it with a concrete threat model: the chalk/debug supply-chain compromise sat live on the registry for roughly two hours before being caught, and package managers responded with cooldown windows that skip freshly published versions. CVE Lite CLI reads the cooldown your project already configures in .npmrc and warns when a recommended fix is newer than that window — so the scanner will not quietly push you onto a version your own package manager would refuse to install. For a remediation-first tool, refusing to undermine the user's supply-chain defenses is exactly the right instinct, and the warning copy explicitly says to validate before overriding the hold.
The operational track record section reads unusually strong for a project of this maturity. The README cites CI adoption at SolidJS, the Government of British Columbia as a required merge gate, French government digital services via DINUM, and Valibot, with claimed production use across France, Canada, Germany, Thailand and China. There is a published GitHub Marketplace action for the CI path, an OpenSSF Best Practices badge, and press coverage from trade outlets including The Register, CSO Online and SecurityWeek — the CSO piece notably centers on the project being deliberately AI-free, positioning deterministic scanning as a counterweight to AI-accelerated code production. The repository sits at roughly 694 stars, written in TypeScript under an MIT license, with CI running on the main branch.
For an authorized security team, the placement options are straightforward. In developer workflows it functions as a pre-commit or pre-merge gate with --fail-on high; in CI it emits SARIF directly consumable by GitHub Code Scanning; in audit contexts it doubles as an SBOM generator via --sbom, which folds dependency inventory and vulnerability posture into a single command. The --check-overrides flag merges the hygiene audit into a regular CVE scan in one pass, which is the right move for teams that want a single pipeline stage rather than a menagerie of specialized checks.
Defenders should also appreciate what this tool does not do. It does not phone home with your dependency tree, does not require a vendor account, and its network-touching behaviors — advisories sync for offline database updates and the --check-network hygiene rules — are explicit, opt-in subcommands rather than background chatter. That makes its telemetry footprint essentially a solved question: from the defender's side, you will see it in CI logs and SARIF uploads, and from the privacy side there is nothing to observe because there is no egress. In an era where even vulnerability scanners have become SaaS data-collection surfaces, a local-first OWASP-badged alternative with validated fix commands is a welcome addition to the JavaScript security toolchain.
OWASP/cve-lite-cli.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.