OWASP/cve-lite-cli

View on GitHub

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.

Stars: 720
Forks: 147
Open beginner issues: 2
Indexed issues: 48
Avg merge: 17h 2m
Merged PRs (30d): 65

Dominant language: TypeScript
License: MIT
Last GitHub push: Sep 19, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: help wanted good first issue

Beginner friendly Everything

Open All

46 open issues indexed

[Bug] Recommended fix version is not checked against advisories introduced above the installed version Open

bug in-house

Difficulty 4/5 3-5 days Newbie friendliness 68/100

OWASP/cve-lite-cli#1198 · Opened Sep 20, 2026
[Bug] An unconfirmed fix version is printed as a copy-run command and stored as validated Open

bug help wanted

Difficulty 4/5 3-5 days Newbie friendliness 55/100

OWASP/cve-lite-cli#1197 · 1 comment · Opened Sep 20, 2026
[Bug] npm advisories without ghsa_id duplicate their OSV counterparts, so CVE counts are inflated Open

bug in-house

Difficulty 4/5 3-5 days Newbie friendliness 15/100

OWASP/cve-lite-cli#1196 · 2 comments · Opened Sep 20, 2026
[Bug] Recommended fix version is the lowest fix across advisories, so the command we print leaves the package vulnerable Open

bug in-house

Difficulty 4/5 3-5 days Newbie friendliness 15/100

OWASP/cve-lite-cli#1195 · Opened Sep 20, 2026
[Docs] OA010 has no website page, and the rule count still says eleven Open

documentation good first issue help wanted

Difficulty 3/5 1-2 days Newbie friendliness 88/100

OWASP/cve-lite-cli#1194 · 2 comments · Opened Sep 20, 2026
[Feature] OA011: override floor exceeds every declaring package's range Open

enhancement help wanted

Difficulty 4/5 3-5 days Newbie friendliness 72/100

OWASP/cve-lite-cli#1193 · Opened Sep 20, 2026
[Bug] an unparseable fix version is reported as "no fix available" Open

bug in-house

Difficulty 3/5 1-2 days Newbie friendliness 15/100

OWASP/cve-lite-cli#1192 · Opened Sep 20, 2026
[Bug] offline DB stores GIT-range commit hashes as versions, so a patched version can match Open

bug in-house

Difficulty 3/5 1-2 days Newbie friendliness 15/100

OWASP/cve-lite-cli#1191 · Opened Sep 20, 2026
[Bug] OA008 calls every flagged copy "below the floor", including copies above the range Open

bug in-house

Difficulty 2/5 1-3 hours Newbie friendliness 10/100

OWASP/cve-lite-cli#1190 · Opened Sep 20, 2026
[Bug] editing the delta comment in place means nobody is told when a PR gets worse Open

bug in-house

Difficulty 4/5 3-5 days Newbie friendliness 15/100

OWASP/cve-lite-cli#1188 · Opened Sep 20, 2026
[Bug] usage scan's 5000-file cap is silent, so --only-used drops real findings on large repos Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 70/100

OWASP/cve-lite-cli#1180 · 9 comments · Opened Sep 20, 2026
[Bug] OA008 message reads "copyies" and lists versions in lexicographic order Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 90/100

OWASP/cve-lite-cli#1179 · 4 comments · Opened Sep 20, 2026
[Bug] satisfiesRange ignores the 0.x caret rule, so ^0.25.0 admits 0.26.0 and up Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

OWASP/cve-lite-cli#1177 · 4 comments · Opened Sep 20, 2026
[Bug] delta advisory-label comment contradicts the code, and Self Scan is permanently red on the smoke-test branch Open

bug in-house

Difficulty 2/5 1-3 hours Newbie friendliness 25/100

OWASP/cve-lite-cli#1170 · Opened Sep 19, 2026
[Bug] --no-cache does not bypass the npm advisory cache Open

bug in-house

Difficulty 3/5 1-2 days Newbie friendliness 15/100

OWASP/cve-lite-cli#1166 · Opened Sep 19, 2026
[Feature] delta input on the Action, so adopters get the PR comment Open

enhancement

OWASP/cve-lite-cli#1158 · 1 assignee · Opened Sep 17, 2026
fix(remediation): parent-update targets render a foreign package's version under the parent's name Open

bug

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/cve-lite-cli#1152 · 2 comments · Opened Sep 17, 2026
fix(output): compact mode truncates findings and fix groups without saying so Open

bug good first issue help wanted

Difficulty 3/5 1-2 days Newbie friendliness 72/100

OWASP/cve-lite-cli#1151 · 2 comments · Opened Sep 16, 2026
fix: isSslCertificateError skips the outer message whenever the error has a cause Open

bug in-house

Difficulty 2/5 1-3 hours Newbie friendliness 20/100

OWASP/cve-lite-cli#1147 · Opened Sep 16, 2026
fix(advisories): a mid-download failure in advisories sync loses the network hint and says only 'terminated' Open

bug in-house

Difficulty 4/5 3-5 days Newbie friendliness 20/100

OWASP/cve-lite-cli#1138 · Opened Sep 15, 2026
feat(cyclonedx): emit the dependencies array, which currently has no dependency graph at all Open

enhancement in-house

Difficulty 3/5 1-2 days Newbie friendliness 15/100

OWASP/cve-lite-cli#1135 · Opened Sep 14, 2026
fix(spdx): a package.json with no name drops every root-anchored edge and the DESCRIBES relationship Open

bug in-house

Difficulty 4/5 3-5 days Newbie friendliness 20/100

OWASP/cve-lite-cli#1134 · Opened Sep 14, 2026
perf(usage): stripComments makes import extraction ~11x slower Open

enhancement in-house

Difficulty 4/5 3-5 days Newbie friendliness 15/100

OWASP/cve-lite-cli#1120 · Opened Sep 11, 2026
fix(workspaces): packages/** and prefix globs are not matched by workspace expansion Open

bug in-house

Difficulty 3/5 1-2 days Newbie friendliness 15/100

OWASP/cve-lite-cli#1119 · Opened Sep 11, 2026
fix(oa009): declaration guard resolves against the root manifest, diverging from PD001 Open

bug in-house

Difficulty 3/5 1-2 days Newbie friendliness 20/100

OWASP/cve-lite-cli#1118 · Opened Sep 11, 2026
feat(scanner): return partial findings on scan timeout via AbortSignal Open

enhancement in-house

Difficulty 5/5 Over a week Newbie friendliness 10/100

OWASP/cve-lite-cli#1105 · Opened Sep 8, 2026
chore: add ESLint to enforce the code quality standards automatically Open

ci enhancement in-house

OWASP/cve-lite-cli#1091 · 1 assignee · Opened Sep 5, 2026
test: add coverage for phantom-utils (getDeclaredPackages and installCmd) Open

first-timers-only good first issue help wanted

Difficulty 2/5 1-3 hours Newbie friendliness 92/100

OWASP/cve-lite-cli#1088 · 6 comments · Opened Sep 5, 2026
feat(action): add sbom input so SPDX output is reachable from the GitHub Action Open

enhancement gh action help wanted

Difficulty 3/5 1-2 days Newbie friendliness 55/100

OWASP/cve-lite-cli#1078 · 1 comment · Opened Sep 5, 2026
--only-used does not scope override-hygiene / maintenance findings in the --fail-on gate Open

documentation in-house

Difficulty 5/5 Over a week Newbie friendliness 20/100

OWASP/cve-lite-cli#1000 · Opened Aug 15, 2026
Performance: Add scan timeout option for large projects Open

enhancement

OWASP/cve-lite-cli#983 · 3 comments · 1 assignee · Opened Aug 13, 2026
fix(PD002): false positives on workspace roots — member-declared dependencies reported as transitive-only phantoms Open

bug

OWASP/cve-lite-cli#966 · 5 comments · 1 reaction · 1 assignee · Opened Aug 10, 2026
docs: complete the Docusaurus (pnpm monorepo) case study Open

case study documentation good first issue

OWASP/cve-lite-cli#912 · 14 comments · 1 assignee · Opened Jul 28, 2026
feat: make --fix / self-fix respect the configured release cooldown (hold back cooldown-window versions) Open

enhancement in-house

Difficulty 4/5 3-5 days Newbie friendliness 20/100

OWASP/cve-lite-cli#873 · Opened Jul 23, 2026
perf: CLI scan performance audit and optimization Open

enhancement

OWASP/cve-lite-cli#837 · 1 comment · 1 assignee · Opened Jul 14, 2026
feat(dm001): add GitHub archive detection as opt-in maintenance risk signal Open

enhancement

OWASP/cve-lite-cli#836 · 1 comment · 1 assignee · Opened Jul 14, 2026
feat: dependency hygiene engine - stale floors, phantom dependencies, and maintenance risk Open

enhancement

OWASP/cve-lite-cli#733 · 3 comments · 1 assignee · Opened Jun 21, 2026
research: evaluate uv.lock (Python) support - separate product or in-scope? Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/cve-lite-cli#672 · 5 comments · 2 reactions · Opened Jun 15, 2026
chore: prebuild-install@7.1.3 deprecated transitive dependency via better-sqlite3 Open

wontfix

Difficulty 5/5 Over a week Newbie friendliness 30/100

OWASP/cve-lite-cli#519 · Opened Jun 1, 2026
feat: add cve-lite learn interactive guided learning command Open

enhancement onhold research

OWASP/cve-lite-cli#512 · 1 assignee · Opened May 31, 2026
chore: add Prettier for consistent code formatting Open

enhancement in-house

OWASP/cve-lite-cli#446 · 1 assignee · Opened May 25, 2026
feat: improve Bun parser to preserve multiple dependency paths to the same package Open

enhancement parser

OWASP/cve-lite-cli#422 · 1 comment · 1 assignee · Opened May 23, 2026
chore: fix TypeScript code quality violations from May 2026 audit Open

enhancement good first issue help wanted refactor

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

OWASP/cve-lite-cli#420 · 16 comments · Opened May 23, 2026
feat: unify JSON output format between --json flag and HTML report's report.json Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 55/100

OWASP/cve-lite-cli#237 · 1 comment · Opened Apr 25, 2026
discussion: dependency graph visualisation in HTML report Open

enhancement question

OWASP/cve-lite-cli#236 · 3 comments · 1 assignee · Opened Apr 25, 2026
Add contextual prioritization signals (usage, reachability hints, exposure) Open

enhancement help wanted

Difficulty 5/5 Over a week Newbie friendliness 38/100

OWASP/cve-lite-cli#126 · 2 comments · Opened Apr 9, 2026

OWASP/cve-lite-cli

Get new issues in your inbox