CVE Lite CLI
CVE Lite CLI is an OWASP project that helps JavaScript and TypeScript developers find and prioritize dependency vulnerabilities before release. It scans npm, pnpm, and Yarn lockfiles locally, matches packages against OSV advisories, separates direct and transitive findings, and provides clear remediation guidance instead of only listing raw CVEs.
About CVE Lite CLI
CVE Lite CLI is a local-first dependency vulnerability scanner for JavaScript and TypeScript projects. It is designed for developers who want a fast, practical way to check dependency risk without sending project source code to a hosted service or adopting a large commercial AppSec platform.
The CLI scans existing lockfiles, queries OSV vulnerability data, classifies findings by severity and dependency relationship, and highlights the fixes that are most likely to reduce risk. It supports npm, pnpm, and Yarn projects, JSON and SARIF output, CI-friendly severity thresholds, local advisory caching, and clear terminal output for day-to-day developer workflows.
The project focuses on helping teams move from vulnerability detection to remediation. Instead of treating every advisory as an isolated alert, CVE Lite CLI shows which issues are direct, which are transitive, which packages have fixed versions available, and what upgrade path should be considered first.
Current focus areas include improving remediation guidance, expanding real-world case studies, strengthening CI/GitHub Action workflows, and building a lightweight, vendor-neutral open source tool that is useful for developers, maintainers, and AppSec teams working in the JavaScript ecosystem.
Media coverage of CVE Lite CLI:
Project Leaders
Sonu Kapoor
Sonu Kapoor is a senior software engineer, open source contributor, technical author, and Google Developer Expert in Angular. He has contributed to developer communities for more than two decades, including work recognized through the Microsoft MVP award and Google’s Angular ecosystem. He is the maintainer of CVE Lite CLI, an OWASP project focused on practical, local-first dependency vulnerability scanning for JavaScript and TypeScript projects. His work focuses on developer tooling, frontend architecture, application security workflows, and making security checks easier to adopt in real-world engineering teams.
Project Information
Slack