google/osv-scanner

What it does

OSV-Scanner is a command-line vulnerability scanner that matches a project's dependencies against advisories in the OSV database. It is the officially supported frontend to OSV and a CLI around the OSV-Scalibr library. It finds vulnerabilities for source directories, lockfiles, container images, and operating system packages, and targets developers who need to audit dependencies across many language ecosystems.

Supported languages include C/C++, Dart, Elixir, Go, Java, JavaScript, PHP, Python, R, Ruby, and Rust, with common package managers such as npm, pip, yarn, Maven, Go modules, Cargo, gem, Composer, and NuGet. Container image scanning covers Alpine, Debian, and Ubuntu OS packages plus Go, Java, Node, and Python artifacts. A call-analysis mode helps reduce false positives by checking whether a vulnerable function is actually reachable, and the tool can also scan vendored C/C++ code. A separate license scanning mode uses deps.dev data to check dependency licenses against an allowed SPDX list.

Install

The recommended route is a prebuilt binary for your platform from the releases page; the installation documentation covers the platform-specific steps. Building from source requires a Go toolchain:

go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest

The README describes instructions for the V2 beta; projects still on V1 should use the V1 documentation.

Scan a project

After installation, run a recursive scan against a source directory:

osv-scanner scan source -r /path/to/your/dir

The scanner walks the directory for supported package files such as package.json, go.mod, or pom.xml, then reports the vulnerabilities discovered for those dependencies. A container image is scanned in the same style:

osv-scanner scan image my-image-name:tag

To check licenses instead, pass --licenses; an allowed list can be supplied as SPDX identifiers, for example osv-scanner --licenses="MIT,Apache-2.0" path/to/directory. The supported lockfile and artifact coverage is listed in the supported languages and lockfiles reference.

Offline and remediation modes

With the offline database downloaded, scans need no further network access:

osv-scanner --offline --download-offline-databases ./path/to/your/dir

The fix command (experimental) recommends package upgrades based on dependency depth, minimum severity, fix strategy, and return on investment. It currently handles npm package-lock.json (in-place changes), npm package.json (relock), and Maven pom.xml (override). Example for npm:

osv-scanner fix --max-depth=3 --min-severity=5 --ignore-dev --strategy=in-place -L path/to/package-lock.json

An interactive mode for npm takes both the manifest and lockfile via -M and -L. The project warns that fix can be risky on untrusted projects because it may trigger package-manager scripts or external registries; only run it on code and artifacts you trust.

Data and privacy

In normal online mode, OSV-Scanner sends package names, versions, ecosystems, and file hashes to the OSV.dev API, and queries the deps.dev API for dependency resolution, container metadata, license information, and deprecation checks. It may also query Maven Central, the npm registry, or PyPI when native registry resolution is used instead of deps.dev. Source code is not transmitted in these requests, and offline mode disables the network calls.

HotRepo's take

OSV-Scanner is a concrete security tool with a narrow, verifiable scope: it wraps OSV advisory data and exposes it through CLI scans, with docs and source available in the repository. In HotRepo's records it appears in the 2026-11-06 daily Go ranking at position 22 with 31 stars added that day, a single snapshot that shows presence on a language leaderboard but says nothing about overall popularity. The project was discussed on Hacker News in December 2022, when commenters welcomed developer-friendly tooling around OSV and a related SBOM question came up; those comments concern the early period, not the current V2 beta. For teams already using OSV or needing multi-ecosystem dependency audits with offline support, the tool targets that workflow directly.