OSV-Scanner
Matches packages from lockfiles, SBOMs and container images against the OSV.dev vulnerability database.
github.com/google/osv-scanner ↗- Stars
- ★ 11,159
- License
- Apache-2.0
- Language
- Go
- Latest release
- v2.6.0 · 14 Sept 2026
- Last push
- 9 Oct 2026
- OpenSSF Scorecard
- 8.6 / 10
Broad ecosystem coverage, the open OSV.dev data, an offline mode and ignore files with reasons.
How it works
OSV-Scanner, from Google, extracts package names and versions from lockfiles and manifests (npm, pip, Go, Cargo, Maven, NuGet and many more), SBOMs and container images. It then queries OSV.dev's batch API. OSV.dev aggregates the GitHub Advisory Database, PyPA, RustSec, the Go vulnerability database, OSS-Fuzz, Linux distribution advisories and the OpenSSF malicious-packages feed in one schema.
With --offline-vulnerabilities it uses a local copy of the database instead. For Go (through govulncheck) and Rust it can do call analysis and mark vulnerabilities whose affected functions are never called. An osv-scanner.toml file ignores specific IDs with a reason and an expiry date.
Output is a table, JSON, SARIF, Markdown or HTML. Google publishes reusable workflows for PR and scheduled scans.
What it catches
- Known vulnerabilities in direct and transitive dependencies
- Known malicious package versions (MAL- IDs)
- Vulnerable OS packages in container images
- Vulnerabilities in vendored C/C++ code identified by commit
Run it
brew install osv-scanner
osv-scanner scan -L package-lock.json
osv-scanner scan -r .What leaves your machine
Package names and versions (not source code) go to api.osv.dev, unless you use the offline database.
Limits
- Lockfile matching reports everything declared, including dev-only packages that never ship. Filter with reachability or ignore entries.
- Call analysis covers Go and Rust only.
- Like any advisory scanner, it can't see a malicious release before someone reports it.
Links
Related tools
GitHub stats as of 10 Oct 2026. How ratings work.