libscan-cli

A compact CLI, a static binary file, scans all dependencies in the project to find security vulnerabilities, unsupported runtimes, and outdated packages, and then produces an immediately usable report.

Why I created this

A typical web app today pulls in hundreds of third-party libraries through Composer or npm. Manually scanning all libraries, checking each one on OSV.dev, Packagist, npm registry, endoflife.date... is a nightmare. Commercial tools exist, but they are often too bulky for small teams, personal projects, or one-time audits to hand over to clients.

libscan-cli was created to fill that gap — running locally on a laptop, dropping into CI, or attaching as a PDF to send to clients, without needing to register for any services.

What it does

You provide the path of the project to libscan-cli. It will find lock files (composer.lock for PHP; package-lock.json, yarn.lock, pnpm-lock.yaml for JavaScript), reading the correct pinned version. For each package, it queries public data sources: OSV.dev for CVEs, Packagist and npm registry to find the latest version, endoflife.date for the EOL status of the runtime and framework. It also supplements with EPSS from FIRST.org and the KEV list from CISA to know which vulnerabilities are actually being exploited in the wild, not just "critical on paper."

Each finding is classified as BLOCK, REVIEW, or OK according to a configurable CVSS threshold — devs or PMs can immediately see which ones need urgent fixing, which ones need reviewing, and which ones can be temporarily set aside. Reports come in four formats: colored text on the terminal, JSON for automation, DOCX and PDF for clients — supporting English, Japanese, and Vietnamese.

Just scan, get verdicts, and export reports.

Detailed usage instructions:

https://viblo.asia/p/libscan-cli-ra-soat-lo-hong-dependency-ym400OBj491