npm vulnerability scanner
Free open-source CVE scanner for npm dependencies. Scan your package.json, get one-command fixes, and export SPDX / CycloneDX SBOMs. No API key, no account.
⭐ Star on GitHub · ⚖️ vs npm audit / Snyk · 📖 How to scan · 📄 Full docs · 📜 Changelog
About this npm vulnerability scanner
The npm vulnerability scanner is a free, open-source tool that scans your package.json for known CVEs (Common Vulnerabilities and Exposures) using the OSV.dev database. It's a modern alternative to Snyk and npm audit — no API key, no account, no tracking.
Unlike npm audit which only lists vulnerabilities, this npm vulnerability scanner gives you copy-and-run fix commands — the exact npm install pkg@safeVersion you need to upgrade each vulnerable dependency. It also generates Software Bills of Materials (SBOM) in SPDX 2.3 and CycloneDX 1.4 formats for compliance.
How the npm vulnerability scanner works
Paste your package.json above and click Scan for Vulnerabilities. The scanner queries OSV.dev (a free, open-source vulnerability database maintained by Google) for each dependency. Results include severity (critical/high/medium/low), the CVE ID, a link to the full advisory, and the patched version to upgrade to.
npm vulnerability scanner vs npm audit vs Snyk
This npm vulnerability scanner is free and open-source (MIT). npm audit is built into npm but is CLI-only and terse. Snyk requires an account and has a limited free tier. This tool provides a web UI, a CLI, a GitHub Action, SBOM generation, and one-command fixes — all free, no account. See the full comparison table on GitHub.
Use the npm vulnerability scanner in CI/CD
Add the GitHub Action to any repo to fail builds on high-severity vulnerabilities and upload SBOM artifacts. The npm vulnerability scanner exits with code 1 when vulnerabilities are found, making it perfect for CI/CD gates.
Frequently asked questions
Is this npm vulnerability scanner free? Yes, 100% free and MIT-licensed. No API key, no account, no rate limits beyond OSV.dev's generous limits.
Does the npm vulnerability scanner upload my code? No. The web app queries OSV.dev directly from your browser. Your code never touches a third-party server.
Can I use the npm vulnerability scanner offline? The web UI requires network access to query OSV.dev. The CLI also queries OSV.dev. An offline mode is on the roadmap.
What SBOM formats does the npm vulnerability scanner support? SPDX 2.3 and CycloneDX 1.4 — the two industry standards for Software Bills of Materials.