OSV-Scanner

What it is

A command-line scanner that reads lockfiles, manifests, OS packages, and container image layers, then matches what it finds against the open OSV.dev advisory database. It covers ecosystems such as npm, pip, Maven, Go modules, Cargo, and Composer, can use call analysis to cut false positives, and works offline against a downloaded database. Developers and security teams run it locally or in CI to catch known vulnerable dependencies, check licenses, and get suggested upgrade paths.