I built CVE Lite CLI out of a frustration I kept running into as a developer: every vulnerability scanner I used would tell me something was broken, then leave me to figure out what to actually do about it. You'd get a list of CVE IDs, maybe a severity rating, and then nothing. The fix was left as an exercise for the reader. The other problem was timing. Most tools live in CI - by the time you see the result, you've already moved on to the next task. Context switching back to a dependency decision you made three hours ago is expensive, and most developers learn to ignore the alerts entirely. So I built something different: a local scanner that reads your lockfile, matches it against OSV advisory data, and tells you the exact npm install, pnpm add, yarn upgrade, or bun add command to fix each finding - including for transitive dependencies buried three levels deep. It runs in under a second with no account and no cloud upload. What started as a personal tool has grown into an OWASP Incubator Project with support for npm, pnpm, Yarn, and Bun; an offline advisory database for air-gapped environments; a ratcheting mode for teams with existing vulnerability debt; and a GitHub Action for CI integration. If you try it: npx cve-lite-cli . --report I'd love to hear what you find.

CVE Lite CLI

Find JS/TS vulnerabilities and get exact fix commands

Find JS/TS vulnerabilities and get exact fix commands