Is bomber an open source dependency scanner?

Yes. bomber is an open source tool that reads an SBOM's declared dependencies and reports the ones with known advisories, which makes it a dependency-focused vulnerability scanner rather than a code or network scanner.

Which providers can bomber query?

OSV by default, which needs no credentials, and OSS Index when you pass --username and --token. The --provider flag selects between ossindex and osv.

Can bomber scan a container image for vulnerabilities?

Not directly. bomber reads SBOMs, not images. Generate an SBOM from the image first with syft or trivy, then feed that file to bomber to check its packages against advisories. On Trickest, wire the SBOM-generating node into the bomber node.

How do I use bomber in CI or a developer workflow?

Set --output json and route the findings into a workflow step that fails on high-severity components, so vulnerable dependencies block a release. On Trickest you can schedule the same graph to re-scan on a cadence.

Which output formats does the bomber node support?

The node's --output flag accepts json, xml, or stdout, defaulting to a stdout summary. Use json or xml when a downstream node needs to parse the findings; use stdout for a quick human-readable pass.

Does bomber scan running applications?

No. It reads an SBOM and matches declared components to advisories. For dynamic testing of a deployed app, pair it with a scanner like nuclei.

Updated Jul 14, 2026

Scanners

Scan an SBOM for known-vulnerable dependencies

Scans software bills of materials for security vulnerabilities.

Audit dependencies for known CVEs Scan many SBOMs in one run Gate a build pipeline on severity

overview

What bomber does

bomber reads a software bill of materials, the structured list of every component and version in a build, and checks each entry against a vulnerability database. Instead of scanning a running app, it answers a supply-chain question: do any of the dependencies you already ship carry a known CVE?

It reads SBOMs in the common formats and queries a provider for matching advisories. OSV is the default and needs no credentials; OSS Index is available when you supply a username and token. Findings come as JSON, XML, or a stdout summary, so they drop straight into a report or a triage table.

On Trickest, bomber is a Scanners node that takes a single SBOM file or a folder of them and writes a file and a folder of results. Generate the SBOM earlier in the workflow, scan it with bomber, and route the vulnerable components into the same findings path as your dynamic scan results.

source github.com/devops-kung-fu/bomber

use cases

Where bomber fits

Audit dependencies for known CVEs

Scan a project's SBOM so every shipped component is checked against an advisory database, catching vulnerable libraries before they reach production.

Scan many SBOMs in one run

Point bomber at a folder of SBOMs to check a fleet of services or images at once and produce a single set of supply-chain findings.

Gate a build pipeline on severity

Emit JSON and route the findings into a workflow step that fails when a high-severity component appears, keeping known-vulnerable dependencies out of a release.

Choose a vulnerability provider

Run against OSV with no credentials for a quick pass, or supply OSS Index credentials with --username and --token when you want that provider's coverage and detail.

reference

bomber inputs and flags

7 inputs

Name	Type	Flag	Description
sbom-file	FILE	·	A single SBOM file to scan.
sbom-folder	FOLDER	·	A folder of SBOMs to scan in one run.
provider	STRING	--provider	Vulnerability provider: ossindex or osv (default osv).
output	STRING	--output	Output format: json, xml, or stdout (default stdout).
token	STRING	--token	API token for the chosen provider.
username	STRING	--username	Username for the chosen provider.

Showing key inputs. bomber exposes 7 inputs in total.

Full flag reference (7 inputs)

Name	Type	Flag	Description
sbom-file	FILE	·	Single SBOM file.
sbom-folder	FOLDER	·	Scan a folder of SBOMs.
provider	STRING	--provider	The vulnerability provider (ossindex, osv) (default "osv").
output	STRING	--output	How bomber should output findings (json, xml, stdout) (default "stdout").
token	STRING	--token	The API token for the provider being used.
username	STRING	--username	The user name for the provider being used.
debug	BOOLEAN	--debug	Displays debug level log messages.

example

Run bomber

bomber · command

# scan a CycloneDX SBOM against OSV and emit JSON findingsbomber scan --provider osv --output json app.cyclonedx.json

sample output

Loaded provider: osv Files:            1Packages:         214Vulnerabilities:  3 SEVERITY   PACKAGE                          VULNERABILITYCRITICAL   pkg:npm/lodash@4.17.15           CVE-2021-23337HIGH       pkg:pypi/pyyaml@5.3.1            CVE-2020-14343MODERATE   pkg:npm/minimist@1.2.5           CVE-2021-44906

guidance

Choosing bomber

Use bomber when you have an SBOM and want to know which components carry known vulnerabilities. It checks a dependency list, not a running app, so generate the SBOM first. For scanning container images or filesystems directly, reach for trivy instead.

trivy

Scans images, filesystems, and SBOMs broadly. bomber is focused purely on SBOM-to-advisory checks.

bandit

Static analysis of Python source. bomber checks declared dependencies rather than your code.

semgrep

Pattern-based static analysis of source. bomber answers the dependency supply-chain question instead.

faq

bomber questions

A software bill of materials, as a single file or a folder of them. bomber reads the components the SBOM lists and checks each one against a vulnerability provider. It does not generate the SBOM, so produce that first with a tool like syft or trivy.

Run bomber yourself

An SBOM feeds bomber, which checks each component against a vulnerability provider and writes the vulnerable dependencies as a queryable output.

Run bomber in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

sbom-file

FILE

A single SBOM file to scan.

sbom-folder

FOLDER

A folder of SBOMs to scan in one run.

provider

STRING

--provider

Vulnerability provider: ossindex or osv (default osv).

output

STRING

--output

Output format: json, xml, or stdout (default stdout).

token

STRING

--token

API token for the chosen provider.

username

STRING

--username

Username for the chosen provider.

Name

Type

Flag

Description

sbom-file

FILE

Single SBOM file.

sbom-folder

FOLDER

Scan a folder of SBOMs.

provider

STRING

--provider

The vulnerability provider (ossindex, osv) (default "osv").

output

STRING

--output

How bomber should output findings (json, xml, stdout) (default "stdout").

token

STRING

--token

The API token for the provider being used.

username

STRING

--username

The user name for the provider being used.

debug

BOOLEAN

--debug

Displays debug level log messages.

Loaded provider: osv Files: 1Packages: 214Vulnerabilities: 3 SEVERITY PACKAGE VULNERABILITYCRITICAL pkg:npm/lodash@4.17.15 CVE-2021-23337HIGH pkg:pypi/pyyaml@5.3.1 CVE-2020-14343MODERATE pkg:npm/minimist@1.2.5 CVE-2021-44906

Scan an SBOM for known-vulnerable dependencies

What bomber does

Where bomber fits

Audit dependencies for known CVEs

Scan many SBOMs in one run

Gate a build pipeline on severity

Choose a vulnerability provider

bomber inputs and flags

Run bomber

Choosing bomber

trivy

bandit

semgrep

bomber questions

More Scanners tools

airixss

alterx

broken-link-checker

chopchop

cmseek

jaeles

Run bomber yourself

Scan an SBOM for known-vulnerable dependencies

What bomber does

Where bomber fits

Audit dependencies for known CVEs

Scan many SBOMs in one run

Gate a build pipeline on severity

Choose a vulnerability provider

bomber inputs and flags

Run bomber

Choosing bomber

trivy

bandit

semgrep

bomber questions

More Scanners tools

airixss

alterx

broken-link-checker

chopchop

cmseek

jaeles

Run bomber yourself