The problem

$ npm audit

# ... 300 lines of this ...
# moderate  Regular Expression Denial of Service in semver
# package   semver
# patched in >=7.5.2
# ...
# 12 vulnerabilities (3 moderate, 6 high, 3 critical)

Nobody reads that. Security gets ignored. Dependencies stay vulnerable.

The solution

npx osv-ui

→ Opens a dashboard. Every CVE, every fix, all your services. Done.

Features

Quick start

Scan current directory:

npx osv-ui

Scan a monorepo (multiple services at once):

npx osv-ui ./frontend ./api ./worker ./ml-service

Auto-discover all services under the current directory:

npx osv-ui --discover

Add to your package.json scripts:

{
  "scripts": {
    "audit:ui":  "npx osv-ui",
    "audit:all": "npx osv-ui ./frontend ./api ./worker"
  }
}

All options:

--discover      Auto-find service dirs that contain a supported manifest
--port=2003     Use a custom port (default: 2003)
--no-open       Don't auto-open the browser
--offline       Skip OSV.dev lookup — parse manifests only

Supported manifest files

More ecosystems coming — see Roadmap.

How it works

Your project files
    │
    ├─ package-lock.json   ──┐
    ├─ requirements.txt    ──┤──► parser ──► package list
    └─ Pipfile.lock        ──┘
                                    │
                                    ▼
                             OSV.dev batch API  (free, no key)
                                    │
                                    ▼
                             CVE matches + fix versions
                                    │
                                    ▼
                         Express server → browser dashboard
                              http://localhost:2003

CVE data comes from OSV.dev — a free, open database maintained by Google that aggregates:

• 🇺🇸 NVD — NIST National Vulnerability Database
• 🐙 GitHub Advisory Database (GHSA)
• 🐍 PyPI Advisory Database
• 📦 npm Advisory Database
• 🦀 RustSec · Go Vuln DB · OSS-Fuzz · and more

Updated daily. No account. No rate limit. No vendor lock-in.

vs alternatives

GitLab CI — block deploys on critical CVEs

No Dependabot on GitLab Free? Add this to .gitlab-ci.yml:

audit:
  stage: test
  image: node:20-alpine
  script:
    - npm audit --json > /tmp/audit.json || true
    - |
      node -e "
        const r = require('/tmp/audit.json');
        const crit = Object.values(r.vulnerabilities || {})
          .filter(v => v.severity === 'critical').length;
        if (crit > 0) {
          console.error('BLOCKED: ' + crit + ' critical CVE(s). Run: npx osv-ui');
          process.exit(1);
        }
        console.log('OK: no critical vulnerabilities');
      "
  artifacts:
    paths: [/tmp/audit.json]
    when: always

Requirements

• Node.js >= 16
• Internet access for OSV.dev queries — or use --offline
• npm projects: run npm install first so package-lock.json exists
• Python projects: any of the supported manifest files listed above

Roadmap

All contributions are welcome. If you want to work on something, open an issue first so we can coordinate.

• Go support — parse go.sum / go.mod
• Rust support — parse Cargo.lock
• Java / Maven — parse pom.xml
• Export report — save as HTML / PDF / JSON
• GitHub Actions — post a CVE diff comment on PRs
• SBOM export — CycloneDX / SPDX format (for Dependency-Track)
• Watch mode — re-scan on manifest file changes
• History / trend — track CVE count per branch over time
• Slack / webhook — notify on new critical CVEs
• Dark mode — for the dashboard UI

Contributing

This project is built by the community. All skill levels welcome.

Good first issues (no deep knowledge required):

• Add Go or Rust manifest parser (follow the pattern in src/parsers.js)
• Improve Python parser edge cases
• Add dark mode to the dashboard CSS
• Write unit tests for the parsers

# Clone and run locally
git clone https://github.com/toan203/osv-ui
cd osv-ui
npm install

# Run against your own project
node bin/cli.js /path/to/your/project

# Run against multiple services
node bin/cli.js ./test-fixtures/npm-project ./test-fixtures/python-project

Please read CONTRIBUTING.md for code style and PR process.

License

MIT — use it, fork it, embed it, build on it. Attribution appreciated but not required.