CVE Lite CLI

CVE Lite CLI is an OWASP Lab Project that scans JavaScript and TypeScript lockfiles for known vulnerabilities and tells you exactly what to run to fix them.

Unlike npm audit or Dependabot, CVE Lite CLI works locally with your actual lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lockb), resolves the full dependency graph, and generates copy-and-run fix commands for both direct and transitive vulnerabilities. When a transitive dependency is the problem, it traces the parent chain and tells you which top-level package to upgrade.

Key capabilities:

• Supports npm, pnpm, Yarn Berry, and Bun lockfiles
• Classifies findings as direct vs. transitive
• Generates severity-grouped fix commands with verified upgrade paths
• HTML report with interactive findings table
• JSON and SARIF output for CI integration
• --fail-on flag for blocking CI pipelines on severity thresholds
• Local advisory cache and full offline mode (--offline, --offline-db)
• Override hygiene auditing to detect stale security exceptions (--check-overrides)
• Import reachability filtering (--only-used) to focus on production-relevant findings
• Minimal runtime footprint (4 dependencies)

CVE Lite CLI runs entirely on your machine - no account, no API key, no data sent to any service. It queries the open OSV (Open Source Vulnerabilities) database directly.

Adopted by engineering teams at Moodys, Vertica, Valibot, and multiple French government ministries (DINUM, DGAFP). Recognized as an OWASP Lab Project in June 2026.