OSV-Scanner
Match a project's lockfiles to known vulnerabilities in the OSV database, including npm.
Last updated
- Price
- Apache-2.0
- Free tier
- Yes
- Checks
- Dependencies
- Last verified
- Oct 14, 2026
What the public pages say
OSV-Scanner connects the dependencies in a project to vulnerabilities in the OSV database. The README's source command scans a directory for package files. It is a dependency check, not a test of authentication or row level security.
The docs do not sell a hosted tier. The license in the repository is Apache-2.0. Data sent to OSV.dev is package names, versions, ecosystems, and file hashes. Use the offline mode described in the README if you do not want that call.
Read the advisory before you upgrade. A clean scan does not mean the app checks who can read a row.
Free tier
The docs describe a CLI and a Go library and do not list a paid plan. The repository LICENSE file is Apache License 2.0, which grants a no-charge copyright license. The README on the GitHub repository says a source scan recursively reads supported package files such as package.json, go.mod, and pom.xml, and that no source code is sent to OSV.dev or deps.dev.
Left off the vendor's site
- A dollar price. The docs and the license do not list one.
- Whether call analysis, guided remediation, or container scanning is on by default for an npm project. The README marks guided remediation experimental.
Sources
- https://google.github.io/osv-scanner/
- https://github.com/google/osv-scanner
- https://raw.githubusercontent.com/google/osv-scanner/main/LICENSE
Listed on ShipSecurely
Put this on OSV-Scanner's site. The image links back to this page.
<a href="https://shipsecurely.dev/tools/osv-scanner"><img src="https://shipsecurely.dev/badge.svg" width="196" height="32" alt="Listed on ShipSecurely"></a>
Markdown version · Canonical page: https://shipsecurely.dev/tools/osv-scanner