OSV-Scanner

OSV-Scanner reads the dependency list from files such as package-lock.json and go.mod and tells you which packages have known vulnerabilities. Point it at your project folder and run it once to get results.

This review is for people who build software with npm, pip, and other package managers. After reading it, you can do the following:

• Check your project’s dependencies for known vulnerabilities
• Understand what OSV-Scanner sends outside and run it offline if needed
• Check dependencies automatically before you commit (pre-commit)

##What OSV-Scanner does

OSV-Scanner works in two steps. First, it extracts the packages used in your project or container image. Then it matches them against OSV.dev, a vulnerability database.

Supported languages include C/C++, Go, Java, JavaScript, Python, and Rust. Supported package managers include npm, pip, yarn, Maven, Go modules, and Cargo. The official documentation lists every supported lockfile.

##What it sends to OSV.dev

According to the README, a normal run sends the following to the OSV.dev API:

• Package names
• Versions
• Ecosystems (npm, PyPI, and so on)
• File hashes, when it scans C/C++ code

It also uses the deps.dev API for dependency resolution and license checks, and sends package names, versions, and ecosystems there. In neither case does it send your source code.

If you don’t want your dependency list to leave your network, use offline mode. With --offline, OSV-Scanner matches against a database you downloaded earlier and sends no project or dependency information anywhere.

##Try it safely on your own project

1. Download the file for your operating system from the releases page. On Windows, winget install Google.OSVScanner also works. On macOS, use brew install osv-scanner.

2. Run it on your project folder. With -r, it scans subfolders too.

   osv-scanner scan source -r ./my-project

3. Read the result table. The OSV URL column links to each vulnerability, and FIXED VERSION shows the version that fixes it. -- means no fix is available yet.

To try it without sending anything, run the following. The first run downloads the database, and later runs use only local data.

osv-scanner --offline --download-offline-databases ./my-project

##Common tasks

--serve shows the HTML report locally on port 8000.

The exit code is 0 when there are no vulnerabilities, 1 when it finds some, and 128 when it finds no files to scan. You can use this to fail CI builds.

OSV-Scanner also supports pre-commit. Add the osv-scanner hook from https://github.com/google/osv-scanner/ to .pre-commit-config.yaml to check dependencies before each commit.

##How it differs from Trivy

Trivy can also check dependencies for vulnerabilities. The main differences are how matching works and how much it covers.

Use OSV-Scanner for a quick dependency check. Use Trivy when you also want to scan containers and configuration files.

##Cautions

##Read next

• cd ../trivyTrivyalso scans container images and configuration files
• cd ../gitleaksGitleaksfinds API keys and other secrets in code