OSV-Scanner
Metrics as of , from the GitHub or GitLab API of each repository. Refreshed monthly.
What OSV-Scanner is
OSV-Scanner is a vulnerability scanner that matches a project's dependencies against advisories in the OSV.dev database. It relies on the OSV-Scalibr library to extract package lists. Documented languages include Go, Rust, Python, Java, JavaScript, Ruby, PHP, Dart, Elixir, R and C/C++. Supported package managers include Cargo, Composer, gem, Go modules, Maven, npm, NuGet, pip and yarn. It also scans container images layer by layer and OS packages on Linux. The CLI scans source directories recursively and can check dependency licenses using deps.dev data. An offline mode scans against a downloaded local database. An experimental fix command suggests version upgrades for npm and Maven projects.
Written from the project's README, read .
- Category
- Security testing
- License
- Apache-2.0
- Language
- Go
- Changelog
- Releases on GitHub
Repository metrics
Status
activeLast commit within 90 days of the fetch date.Computed from the last commit date and the archive flag on the fetch date. See the status rules.
Alternatives
Listed security testing tools, same primary language first, then by GitHub stars. Each line gives one fact from the tool's documentation where it differs from OSV-Scanner's, with its source.
Trivy: Scan targets: Container images, filesystems, remote Git repositories, virtual machine images, Kubernetes. source: README
Nuclei: Scan targets: Target URLs and hosts, from a single target or a list file. source: README
Gitleaks: Scan targets: Secrets such as passwords, API keys and tokens in git repositories, files and stdin. source: README
ffuf: Scan targets: Web servers: content paths, virtual hosts, GET parameters and POST data. source: README
sqlmap: Scan targets: Web application parameters: GET, POST, cookie, User-Agent and Referer values. source: Docs: Features
Promptfoo: Scan targets: LLM apps, through red teaming and vulnerability scanning. source: README
ZAP: Scan targets: Web applications. source: README
Nikto: Scan targets: Web servers: potentially dangerous files or programs, outdated server components. source: Docs: Overview & Description
How to install
go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latestQuestions
Is OSV-Scanner open source?
Yes. OSV-Scanner is released under Apache-2.0, an OSI-approved license, as reported by the GitHub API on 2026-09-22.
Is OSV-Scanner maintained?
On 2026-09-22, the last commit to the default branch was on 2026-09-22, so the listed status is active. Rule: Last commit within 90 days of the fetch date.
How many GitHub stars does OSV-Scanner have?
11,073 stars on 2026-09-22, from the GitHub API. The number is refreshed at each monthly update.
What language is OSV-Scanner written in?
The repository's primary language, as reported by the GitHub API, is Go.
How do I install OSV-Scanner?
The README gives this command: go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
Sources
- GitHub REST API: repository, read
- GitHub REST API: commits, read
- GitHub REST API: latest release, read
- GitHub REST API: contributors, read
- README, read