Skip to content

Back to the catalog

CVE Lite CLI
github.comrepo

CVE Lite CLI

CVE Lite CLI is an OWASP Lab Project CLI that scans npm, pnpm, Yarn, and Bun lockfiles against OSV and the npm advisory API and outputs copy-and-run fix commands instead of raw CVE lists, with parent-aware guidance for transitive dependencies. Beyond core CVE scanning it audits override/resolution hygiene, flags maintenance risk (deprecated direct deps and version drag blocking fixes), warns when a suggested fix falls inside a package manager's release-cooldown window (referencing the chalk/debug npm compromise), and emits SARIF, SPDX/CycloneDX SBOMs, and EPSS-based priority tiers, plus a GitHub Action that opens batched fix PRs.

TL;DR Local-first OWASP CLI that scans JS/TS lockfiles and gives copy-run fix commands, SBOMs, and override-hygiene checks instead of just a CVE list.
Open original ↗
Document

What it is

CVE Lite CLI, an OWASP Lab Project, is an npm-installable command-line scanner (npm install -g cve-lite-cli or npx cve-lite-cli) that reads npm/pnpm/Yarn/Bun lockfiles, queries OSV and the npm registry advisory API, and emits copy-and-run fix commands. The page adds operational detail the summary omits: the actual flag surface, an offline advisory-DB workflow, an in-place fix mode, and an EPSS-based prioritization signal.

How it works

It resolves each finding to a package-manager-specific install command (npm install, pnpm add, yarn add, bun add) rather than a CVE list. For transitive vulnerabilities it is parent-aware: the DM001 rule identifies when npm update <parent> re-resolves a non-vulnerable child within the current parent range, versus when the parent itself needs a breaking major upgrade the scanner would otherwise leave unexplained. An EPSS priority signal combines CVSS severity with exploitation likelihood into four tiers. Release-cooldown awareness reads whichever key your project already sets — min-release-age (npm), minimumReleaseAge (pnpm), or npmMinimalAgeGate (Yarn) — and warns when a recommended fix is newer than that window; it never invents a window and does not change exit codes.

What to do

Core invocations from the page:

cve-lite /path/to/project --verbose         # full fix plan with dependency paths
cve-lite /path/to/project --fix             # apply validated direct fixes and rescan
cve-lite /path/to/project --fail-on high    # exit non-zero on high severity and above
cve-lite /path/to/project --sarif           # SARIF for GitHub Code Scanning
cve-lite /path/to/project --sbom spdx       # SPDX 2.3 SBOM (also: --sbom cyclonedx)
cve-lite /path/to/project --check-overrides # CVE scan + override hygiene in one pass
cve-lite /path/to/project --check-maintenance
cve-lite /path/to/project --check-licenses

For air-gapped/restricted CI, populate a local DB and scan without network:

cve-lite advisories sync            # sync advisory DB for offline use
cve-lite /path/to/project --offline # no runtime API calls

Override hygiene can run standalone with auto-fix (cve-lite /path/to/project overrides --fix), which is faster and fully offline-capable since it skips the CVE scan.

Caveats

  • --fix applies validated direct fixes only; transitive and major-upgrade cases still require manual action.
  • Maintenance-risk "Last release" age is informational, not a severity signal on its own.
  • The release-cooldown warning is advisory: on by default, no flag, and it does not fail the build.
  • Version v1.26.0 adds a scheduled GitHub Action fix mode (page text is truncated on the detail).

Technologies named here

Techniques named here

  • Lockfile vulnerability scanning
  • Parent-aware transitive remediation
  • Override/resolution hygiene auditing
  • Maintenance risk detection
  • Release cooldown awareness
  • EPSS priority tiering
  • SBOM generation with attached findings
  • Offline/air-gapped scanning

Threat actors named here

  • chalk/debug compromise

Related in Supply Chain