Static Code Analysis
Match a lockfile to known OSV advisories
A lockfile in, advisory rows out.
overview
What osv-scanner does
OSV-Scanner reads lockfiles and requirements files in the connected folder and writes one JSONL row per known advisory.
A Managed-fleet smoke on requirements.txt pinning PyYAML 5.3.1 included GHSA-8q59-q68h-6hv4. The sample shows that row.
The row names the package, the version, the advisory id, and the file that declared the dependency.
use cases
Where osv-scanner fits
Scan a Python requirements file
Connect the folder that holds requirements.txt and read the advisory ids.
Name the vulnerable package
Each row carries the package name and version next to the advisory id.
Pass advisories downstream
JSONL is ready for a filter that keeps high-severity ids.
reference
osv-scanner inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input | FOLDER | --input | Folder to scan. |
Showing key inputs. osv-scanner exposes 1 inputs in total.
example
Run osv-scanner
osv-scanner --input ./project{"detector_id": "GHSA-8q59-q68h-6hv4", "package_name": "pyyaml", "package_version": "5.3.1", "evidence_excerpt_redacted": "Improper Input Validation in PyYAML"}guidance
Choosing osv-scanner
Use OSV-Scanner for known vulnerabilities in lockfiles. Use OSV Malicious when the question is a malware advisory on a package coordinate.
osv-malicious
Looks up package coordinates against known-malicious OSV ids.
guarddog
Checks package coordinates for malware indicators.
trufflehog
Searches files for secrets rather than dependency advisories.
faq
osv-scanner questions
related
More Static Code Analysis tools
bandit
Python source in, JSON security findings out.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
guarddog
A package coordinate in, indicator hits out.
malcontent-scan
A package coordinate in, behavior findings out.
osv-malicious
A package coordinate in, malware advisory rows out.
Run osv-scanner yourself
requirements.txt pinning PyYAML 5.3.1 produced a findings file that includes GHSA-8q59-q68h-6hv4.
Facts on this page come from the live Trickest tool library.