CVE Lite CLI

CVE Lite CLI is a free SCA scanner for JavaScript and TypeScript projects, run from the terminal against your lockfile.

It is an OWASP Lab Project, MIT licensed, and maintained in public by Sonu Kapoor.

The GitHub repository sits at 658 stars, and the npm package has drawn roughly 27,800 downloads in the last 30 days (checked 5 August 2026).

The scope is deliberately narrow. There is no hosted dashboard, no vendor-run monitoring service, and no coverage outside the JavaScript ecosystem.

What is CVE Lite CLI?

CVE Lite CLI reads resolved package versions from a supported lockfile and checks each one against the OSV database.

That means it works from lockfile state rather than the version ranges declared in package.json. Development dependencies are included unless you pass --prod-only.

Only package names and exact versions cross the network boundary. Source code, environment variables, and secrets stay on the machine, and no hosted account is involved.

The tool queries OSV rather than NVD or GHSA directly.

Its documentation gives the reasoning: NVD indexes by CPE strings that map poorly to npm package names, and OSV already ingests GHSA as a first-class feed.

What are CVE Lite CLI’s key features?

Parent-aware transitive remediation

Upgrading a vulnerable transitive package directly rarely holds, because the parent that pinned it will pull the old version back on the next install.

When the lockfile exposes the dependency path, CVE Lite CLI identifies the parent package that controls the vulnerable child version.

For npm it separates two cases. npm update <parent> applies when the current parent range can already absorb a fixed child; npm install <parent>@<version> applies when the range itself has to move.

Direct findings go through a validation pass where registry data allows it. The target must be newer than the installed version and not itself known vulnerable.

Pre-release versions are skipped during registry-based parent checks.

If the CLI cannot validate a target, it reports the nearest parent context without printing a fix command.

The coverage notes in that output are the scanner stating its own boundaries: no exploitability proof, no node_modules verification, no container or IaC scanning.

Offline advisory database

cve-lite advisories sync pulls OSV data into a local SQLite file, and --offline scans against it with no runtime advisory API calls.

The project reports one local benchmark for the sync path: about 217,065 advisory records ingested in 8.84 seconds, down from 87.53 seconds before SQLite bulk-ingest work.

For networks that cannot reach OSV at all, cve-lite advisories init creates an empty database to populate from internal advisory sources.

It refuses to overwrite an existing file, so point --output at a fresh path.

Override hygiene auditing

JavaScript package managers use overrides and resolutions to pin a transitive package to a chosen version. Those entries can go stale as the dependency tree moves on, and the package manager may not flag the drift.

The overrides subcommand audits them against 11 documented rules . --check-overrides folds the same audit into a normal scan, and --rule=OA007 runs a single check.

Output formats and CI controls

--json, --sarif, and --cdx can be combined, and each writes a timestamped file. --report generates the HTML view and opens it in a browser unless you add --no-open.

For pipelines, --fail-on sets the severity that returns exit code 1, defaulting to critical.

--ratchet writes a baseline on first run and afterwards fails only on findings above it. In multi-folder mode each subfolder gets its own .cve-lite/baseline.json.

Corporate SSL inspection is handled with --ca-cert, and --osv-url points at an internal OSV mirror.

That flag enforces HTTPS and blocks private IP ranges by default as an SSRF guard. --allow-private-osv-url opens it for trusted internal hosts.

CVE Lite CLI vs npm audit

npm audit needs no installation at all. It ships with npm, runs against the tree npm already resolved, and is the shortest path to a first answer on an npm-only project.

CVE Lite CLI covers more ground on the input side. It reads pnpm, Yarn, and Bun lockfiles as well as npm’s, which matters for monorepos and teams that have moved off npm.

The output side differs more. CVE Lite CLI classifies each finding as direct or transitive with the dependency path attached, and writes SARIF 2.1.0 and CycloneDX 1.4 files that npm audit does not produce.

Pick npm audit if your project is npm-only and you want zero setup. Pick CVE Lite CLI if you need multi-package-manager coverage, SARIF for a security dashboard, or an SBOM artifact.

CVE Lite CLI vs OSV-Scanner

Both tools query the same OSV database, so the underlying advisory data is the same. The difference is scope.

OSV-Scanner is Google’s Apache 2.0 scanner covering 11+ language ecosystems and 19+ lockfile formats, plus layer-aware container scanning for Debian, Ubuntu, and Alpine.

Its guided remediation ranks upgrades by dependency depth, severity, and return on investment.

CVE Lite CLI does none of that. It covers JavaScript and TypeScript only, with no container scanning and no cross-ecosystem support.

What it adds instead is npm-specific depth: override and resolution hygiene across ten rules, and a fully offline SQLite advisory workflow with no runtime API calls.

Pick OSV-Scanner if your stack is polyglot or you scan container images. Pick CVE Lite CLI if you are JS/TS-only and want override auditing or air-gapped scanning.

CVE Lite CLI vs Dependabot

Dependabot is GitHub’s built-in option, free on every repository, covering 30+ package ecosystems and drawing on the GitHub Advisory Database. It opens pull requests automatically, which is the reason most teams adopt it.

That automation is also its shape: Dependabot runs on GitHub, after a push, on a schedule you configure.

CVE Lite CLI runs wherever the terminal is, before the commit, and produces no pull requests on its own. It also works on repositories hosted outside GitHub.

Pick Dependabot if you want continuous, hands-off PRs on GitHub. Pick CVE Lite CLI for a pre-commit check, non-GitHub hosting, or a scan that produces no PR traffic.

The two are commonly run together.

How much does CVE Lite CLI cost?

Nothing. CVE Lite CLI is MIT licensed with no commercial edition, no paid tier, and no seat-based pricing.

There is no hosted service attached, so there is nothing to subscribe to and no account to create. Every documented flag, including the offline database and the HTML report, is in the free package.

The practical cost is operational: you own the CI wiring, the advisory database sync in restricted networks, and the triage.

How do you get started with CVE Lite CLI?

1. Install it — npm install -g cve-lite-cli, or run npx cve-lite-cli once without installing.
2. Scan the project — cve-lite . detects the lockfile and reports findings at medium severity and above.
3. Read the full picture — cve-lite . --verbose adds the severity table, fix plan, and coverage notes.
4. Wire it into CI — cve-lite . --fail-on high returns exit code 1 on high or critical findings.
5. Adopt incrementally — cve-lite . --ratchet baselines the existing backlog so only new findings break the build.

# Install globally
npm install -g cve-lite-cli

# Or run once without installing
npx cve-lite-cli

# Scan the current directory
cve-lite .

# Full output: severity table, fix plan, findings, coverage notes
cve-lite . --verbose

# Production dependencies only, high severity and above
cve-lite . --prod-only --min-severity high

# Generate an HTML report without opening a browser
cve-lite . --report --no-open

# Sync advisories, then scan with no advisory API calls
cve-lite advisories sync
cve-lite . --offline

# CI: fail the build on high or above
cve-lite . --fail-on high

# Audit overrides and resolutions
cve-lite overrides .

--fix auto-applies fix commands for direct dependencies only in its current version, and cannot be combined with --json, --sarif, or --cdx.

When should you use CVE Lite CLI?

It fits JS/TS projects that want local or CI lockfile scanning without a hosted account, and teams running a mix of npm, pnpm, Yarn, and Bun across repositories.

The offline database also makes it a candidate for restricted networks, where the advisory file is prepared elsewhere and carried in.

The override audit is the clearest difference in the project’s published comparison with npm audit, OSV-Scanner, Snyk CLI, and Socket CLI. If your team has been pinning transitive packages through overrides for a while, those entries are worth checking on their own.

It is a poor fit as a single scanner for a polyglot codebase, or as a replacement for a platform that tracks findings over time.

What are alternatives to CVE Lite CLI?

For the same job on a broader stack, OSV-Scanner queries the same OSV data across 11+ ecosystems and container images.

Trivy covers dependencies, container images, IaC, and secrets in one binary, which suits teams that want a single scanner rather than a JS-specific one.

Dependabot is the zero-setup option for GitHub-hosted repositories, and Snyk adds a hosted dashboard, continuous monitoring, and fix PRs on a commercial plan.

The full free-tier landscape is in my open source SCA tools guide.

What are CVE Lite CLI’s limitations?

Strengths:

• All four JS lockfile formats in one tool, including Bun
• Transitive findings resolve to the parent you can actually upgrade
• Registry-backed validation of fix targets where metadata supports it
• Offline scanning with no runtime advisory calls
• Override hygiene auditing across 11 documented rules
• SARIF and CycloneDX output for existing pipeline tooling

Limitations:

• JavaScript and TypeScript only — no Python, Java, Go, Rust, container, or IaC scanning
• No license compliance analysis
• No hosted dashboard or vendor-run monitoring between scheduled runs
• --fix covers direct dependencies only in the current version
• One maintainer accounts for most commits, with a smaller contributor group around the project
• Exploitability and runtime reachability are out of scope by design

Further reading: What is SCA? | SCA in CI/CD Pipelines | Open Source SCA Tools

Frequently Asked Questions