OWASP Incubator Project Scans JavaScript Dependencies for Vulnerabilities
Summary
OWASP has adopted CVE Lite CLI as an Incubator Project. The open-source, OSV-powered scanner checks JavaScript and TypeScript lockfiles for vulnerable npm, pnpm and Yarn dependencies and recommends replacement commands, according to its developer.
Key points
- CVE Lite CLI is an open-source command-line dependency scanner recently adopted as an OWASP Incubator Project.
- It scans lockfiles for JavaScript and TypeScript projects using npm, pnpm and Yarn.
- The tool's developer says it uses OSV and can recommend commands to replace vulnerable dependencies with safer alternatives.
- The developer says the scanner checks recommended replacement packages for vulnerabilities as well.
- The article presents local scans that complete in seconds as an alternative to waiting for CI scans.
Article Details
- Event Type
- CVE Lite CLI was adopted as an OWASP Incubator Project.
- Impact
- The open-source dependency scanner checks JavaScript and TypeScript project lockfiles locally in seconds and recommends commands to replace vulnerable packages with safer alternatives. It also scans the recommended replacement to check that the fix is not still vulnerable.