OSV-Scanner
Checks a project's dependencies against the OSV vulnerability database and lists those with a known flaw. Covers many languages, package managers and container images. Apache-2.0 licence.
Strengths
- Backed by Google's OSV database, free and open
- Reads the lockfiles of many ecosystems with a single command
Limitations
- A listed flaw is not necessarily reachable in your code: the noise needs triage
- A binary to install separately (release or go install), not an npm package
Best for
- Checking a repo an agent has filled with dependencies