OWASP/cve-lite-cli

View on GitHub

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.

Stars: 720
Forks: 147
Open beginner issues: 3
Indexed issues: 51
Avg merge: 14h 56m
Merged PRs (30d): 81

Dominant language: TypeScript
License: MIT
Last GitHub push: Sep 19, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: help wanted good first issue

Beginner friendly Everything

Open All

[Bug] Very noisy install Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 52/100

OWASP/cve-lite-cli#1223 · 4 comments · 1 reaction · Opened Sep 22, 2026
OA010 is unreachable from the documented scan path and no-ops silently Open

bug in-house

Difficulty 4/5 3-5 days Newbie friendliness 15/100

OWASP/cve-lite-cli#1222 · Opened Sep 22, 2026
[Feature] OA011: override floor exceeds every declaring package's range Open

enhancement help wanted

Difficulty 4/5 3-5 days Newbie friendliness 72/100

OWASP/cve-lite-cli#1193 · 2 comments · 1 assignee · Opened Sep 20, 2026
[Bug] OA008 calls every flagged copy "below the floor", including copies above the range Open

bug in-house

Difficulty 2/5 1-3 hours Newbie friendliness 10/100

OWASP/cve-lite-cli#1190 · Opened Sep 20, 2026
[Bug] editing the delta comment in place means nobody is told when a PR gets worse Open

bug in-house

Difficulty 4/5 3-5 days Newbie friendliness 15/100

OWASP/cve-lite-cli#1188 · Opened Sep 20, 2026
[Bug] usage scan's 5000-file cap is silent, so --only-used drops real findings on large repos Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 70/100

OWASP/cve-lite-cli#1180 · 9 comments · Opened Sep 20, 2026
[Feature] delta input on the Action, so adopters get the PR comment Open

enhancement

OWASP/cve-lite-cli#1158 · 1 assignee · Opened Sep 17, 2026
fix(output): compact mode truncates findings and fix groups without saying so Open

bug good first issue help wanted

Difficulty 3/5 1-2 days Newbie friendliness 72/100

OWASP/cve-lite-cli#1151 · 4 comments · Opened Sep 16, 2026
fix: isSslCertificateError skips the outer message whenever the error has a cause Open

bug in-house

Difficulty 2/5 1-3 hours Newbie friendliness 20/100

OWASP/cve-lite-cli#1147 · Opened Sep 16, 2026
fix(advisories): a mid-download failure in advisories sync loses the network hint and says only 'terminated' Open

bug in-house

Difficulty 4/5 3-5 days Newbie friendliness 20/100

OWASP/cve-lite-cli#1138 · Opened Sep 15, 2026
feat(cyclonedx): emit the dependencies array, which currently has no dependency graph at all Open

enhancement in-house

Difficulty 3/5 1-2 days Newbie friendliness 15/100

OWASP/cve-lite-cli#1135 · Opened Sep 14, 2026
fix(spdx): a package.json with no name drops every root-anchored edge and the DESCRIBES relationship Open

bug in-house

Difficulty 4/5 3-5 days Newbie friendliness 20/100

OWASP/cve-lite-cli#1134 · Opened Sep 14, 2026
perf(usage): stripComments makes import extraction ~11x slower Open

enhancement in-house

Difficulty 4/5 3-5 days Newbie friendliness 15/100

OWASP/cve-lite-cli#1120 · Opened Sep 11, 2026
fix(workspaces): packages/** and prefix globs are not matched by workspace expansion Open

bug in-house

Difficulty 3/5 1-2 days Newbie friendliness 15/100

OWASP/cve-lite-cli#1119 · Opened Sep 11, 2026
fix(oa009): declaration guard resolves against the root manifest, diverging from PD001 Open

bug in-house

Difficulty 3/5 1-2 days Newbie friendliness 20/100

OWASP/cve-lite-cli#1118 · Opened Sep 11, 2026
feat(scanner): return partial findings on scan timeout via AbortSignal Open

enhancement in-house

Difficulty 5/5 Over a week Newbie friendliness 10/100

OWASP/cve-lite-cli#1105 · Opened Sep 8, 2026
chore: add ESLint to enforce the code quality standards automatically Open

ci enhancement in-house

OWASP/cve-lite-cli#1091 · 1 assignee · Opened Sep 5, 2026
test: add coverage for phantom-utils (getDeclaredPackages and installCmd) Open

first-timers-only good first issue help wanted

Difficulty 2/5 1-3 hours Newbie friendliness 92/100

OWASP/cve-lite-cli#1088 · 6 comments · Opened Sep 5, 2026
feat(action): add sbom input so SPDX output is reachable from the GitHub Action Open

enhancement gh action help wanted

Difficulty 3/5 1-2 days Newbie friendliness 55/100

OWASP/cve-lite-cli#1078 · 1 comment · Opened Sep 5, 2026
--only-used does not scope override-hygiene / maintenance findings in the --fail-on gate Open

documentation in-house

Difficulty 5/5 Over a week Newbie friendliness 20/100

OWASP/cve-lite-cli#1000 · Opened Aug 15, 2026
Performance: Add scan timeout option for large projects Open

enhancement

OWASP/cve-lite-cli#983 · 3 comments · 1 assignee · Opened Aug 13, 2026
fix(PD002): false positives on workspace roots — member-declared dependencies reported as transitive-only phantoms Open

bug

OWASP/cve-lite-cli#966 · 5 comments · 1 reaction · 1 assignee · Opened Aug 10, 2026
docs: complete the Docusaurus (pnpm monorepo) case study Open

case study documentation good first issue

OWASP/cve-lite-cli#912 · 14 comments · 1 assignee · Opened Jul 28, 2026
feat: make --fix / self-fix respect the configured release cooldown (hold back cooldown-window versions) Open

enhancement in-house

Difficulty 4/5 3-5 days Newbie friendliness 20/100

OWASP/cve-lite-cli#873 · Opened Jul 23, 2026
perf: CLI scan performance audit and optimization Open

enhancement

OWASP/cve-lite-cli#837 · 1 comment · 1 assignee · Opened Jul 14, 2026
feat(dm001): add GitHub archive detection as opt-in maintenance risk signal Open

enhancement

OWASP/cve-lite-cli#836 · 1 comment · 1 assignee · Opened Jul 14, 2026
feat: dependency hygiene engine - stale floors, phantom dependencies, and maintenance risk Open

enhancement

OWASP/cve-lite-cli#733 · 3 comments · 1 assignee · Opened Jun 21, 2026
research: evaluate uv.lock (Python) support - separate product or in-scope? Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/cve-lite-cli#672 · 5 comments · 2 reactions · Opened Jun 15, 2026
chore: prebuild-install@7.1.3 deprecated transitive dependency via better-sqlite3 Open

wontfix

Difficulty 5/5 Over a week Newbie friendliness 30/100

OWASP/cve-lite-cli#519 · Opened Jun 1, 2026
feat: add cve-lite learn interactive guided learning command Open

enhancement onhold research

OWASP/cve-lite-cli#512 · 1 assignee · Opened May 31, 2026
chore: add Prettier for consistent code formatting Open

enhancement in-house

OWASP/cve-lite-cli#446 · 1 assignee · Opened May 25, 2026
feat: improve Bun parser to preserve multiple dependency paths to the same package Open

enhancement parser

OWASP/cve-lite-cli#422 · 1 comment · 1 assignee · Opened May 23, 2026
chore: fix TypeScript code quality violations from May 2026 audit Open

enhancement good first issue help wanted refactor

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

OWASP/cve-lite-cli#420 · 16 comments · Opened May 23, 2026
feat: unify JSON output format between --json flag and HTML report's report.json Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 55/100

OWASP/cve-lite-cli#237 · 2 comments · Opened Apr 25, 2026
discussion: dependency graph visualisation in HTML report Open

enhancement question

OWASP/cve-lite-cli#236 · 3 comments · 1 assignee · Opened Apr 25, 2026
Add contextual prioritization signals (usage, reachability hints, exposure) Open

enhancement help wanted

Difficulty 5/5 Over a week Newbie friendliness 38/100

OWASP/cve-lite-cli#126 · 3 comments · Opened Apr 9, 2026

OWASP/cve-lite-cli

Get new issues in your inbox