CLI for Google OSV database. Query vulnerabilities for packages, scan local projects for vulnerable dependencies. **Dependency**: This is an x-cmd module. In...
Query Google OSV database for package vulnerabilities and scan local projects.
# Query vulnerability for a package
x osv q -p jq -v 1.7.1
# Scan local project for vulnerabilities (requires osv-scanner)
x osv scanner .
| Tool | Purpose | Install |
|---|---|---|
| x-cmd | Required module runtime | brew install x-cmd |
| osv-scanner | Project scanning | https://github.com/google/osv-scanner |
| Command | Description |
|---|---|
x osv q <pkg> | Query vulnerabilities for a package |
x osv scanner <path> | Scan project for vulnerabilities (requires osv-scanner) |
x osv vuln <id> | Get vulnerability details |
x osv sarif | Generate SARIF security reports |
x osv eco | List supported ecosystems |
# Query specific package version
x osv q -p jq -v 1.7.1
# Query by commit hash
x osv q -c 6879efc2c1596d11a6a6ad296f80063b558d5e0f
# Scan current directory (requires osv-scanner installed)
x osv scanner .
# Scan specific lockfile
x osv scanner --lockfile requirements.txt
x osv scanner --lockfile package-lock.json
# Scan npm project
x osv sarif npm ./my-project/
# Scan pip project with JSON output
x osv sarif pip ./project/ --json
View all supported ecosystems:
x osv eco
Includes: npm, PyPI, Maven, Go, Rust, NuGet, Packagist, etc.
No API key required for basic usage. Rate limits apply for unauthenticated requests.
ZIP package — ready to use