Install OSV-Scanner, then run it against a lockfile with scan -L, or against a whole directory with scan -r. It matches your dependencies against the open OSV.dev database and lists known vulnerabilities. Read the results, fix items with an available fixed version, and record anything you defer.
What the tool is
OSV-Scanner describes itself as an officially supported frontend to the OSV database. It connects a project's dependencies with the vulnerabilities that affect them, and can run as a command line tool. The OSV.dev data comes from authoritative sources, such as the RustSec Advisory Database for Rust.
The two commands to know
Scan one lockfile:
osv-scanner scan -L package-lock.json
Scan a directory and everything below it:
osv-scanner scan -r ./my-project-dir/
Two flags are useful straight away. Use format json to get machine-readable output, and output-file to save results instead of printing them. There is also a serve flag that builds an HTML report and serves it locally on port 8000, which is friendlier for reading a long list.
Read the output in this order
- Package and version. Is this something you actually run?
- Advisory ID. It may be a CVE, a GHSA or an OSV ID. These are different identifier systems that often point to the same issue.
- Fixed version. If one is listed, that is your first action.
- Severity. Treat it as a hint, not a verdict.
- Exploitation. Check any CVE against the CISA exploited list.
Handling transitive dependencies
OSV-Scanner can resolve transitive dependencies for manifests, and there is a no-resolve flag to turn that off. Transitive findings are real exposure, but you fix them by upgrading the parent package or applying an override in your package manager, so give yourself time for those.
Make it a habit
Add the command to your weekly routine, or run it before each release. Because it reads lockfiles, keep lockfiles committed and current. A stale lockfile produces a stale answer.
What it does not tell you
The scan reports known advisories. It does not tell you whether your code calls the vulnerable function, whether your code has its own bugs, or whether a package is malicious but not yet reported. Treat it as one input.
Quick check
Do I need an account to use OSV-Scanner?
The documentation I reviewed describes a command line tool and an open database, and does not mention an account. Check the current installation guide for your platform.
Which file should I scan, the manifest or the lockfile?
The lockfile, because it records the exact versions you install.
Safeguard offers SBOM and dependency scanning, including a CLI, and there is a free web scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
