OSV-Scanner
Finds dependencies with known vulnerabilities by reading lockfiles and manifests.
Why install it
Section titled “Why install it”Most exploitable flaws in an application live in its dependencies. OSV-Scanner reads the lockfiles of every major ecosystem and matches them against the OSV database, so a review reports a vulnerable version the moment a change introduces it.
At a glance
Section titled “At a glance”| Finds | Dependencies |
| Reads | Any language |
| Trust level | Safe on untrusted input |
| Official image | Included |
| Licence | Apache-2.0 |
| Argus tool | run_osv_scanner |
Install
Section titled “Install”The official Argus container image already ships OSV-Scanner. Anywhere else, install this binary on the daemon host:
osv-scanner:brew install osv-scanner (or go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest)
For other platforms, follow the official install guide. Argus looks for scanners once, when the daemon starts: restart it after installing, and argus doctor shows OSV-Scanner as installed.