{"id":4144,"date":"2026-05-26T14:45:48","date_gmt":"2026-05-26T14:45:48","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/05\/26\/owasp-adopts-cve-lite-cli-to-boost-dependency-scanning\/"},"modified":"2026-05-26T14:45:48","modified_gmt":"2026-05-26T14:45:48","slug":"owasp-adopts-cve-lite-cli-to-boost-dependency-scanning","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/05\/26\/owasp-adopts-cve-lite-cli-to-boost-dependency-scanning\/","title":{"rendered":"OWASP Adopts CVE Lite CLI to Boost Dependency Scanning"},"content":{"rendered":"
\"\"<\/div>\n

\"\"<\/p>\n

Checking for dependency vulnerabilities in freshly developed software is usually done near the end of the build process. Remediation at that point can be tricky.\u00a0<\/span><\/p>\n

Now, JavaScript and TypeScript developers can check for vulnerabilities themselves as they \u2013 or their agents \u2013 write their source code, using an open source project called <\/span>CVE Lite CLI<\/span><\/a>.\u00a0<\/span><\/p>\n

Last month, the <\/span>Open Worldwide Application Security Project <\/span><\/a>(OWASP) accepted CVE Lite CLI as an incubating project. <\/span>Sonu Kapoor <\/span><\/a>specifically created CVE Lite CLI to check vulnerabilities earlier in the development cycle.\u00a0<\/span><\/p>\n

Kapoor\u2019s approach can be seen as a form of \u201cshift left,\u201d where the developer assumes more responsibility in ensuring the security of their code. It differs from how vulnerability scanning is typically done within production workflows, where security is a separate test that happens at the end of the development cycle.\u00a0<\/span><\/p>\n

Once installed, the app can scan your lockfiles \u2013 the dependency tree configuration \u2013\u00a0 and check the installed dependencies for any vulnerabilities they may have, by referencing the <\/span>Open Source Vulnerabilities<\/span><\/a> database. If a vulnerability is found, it then generates a set of ready-to-copy commands that can be pasted into the command line to update from your given package manager (npm, pnpm, Yarn and Bun are currently supported).<\/span><\/p>\n

CVE Lite CLI can also work offline, caching all the CVEs on a local database.\u00a0<\/span><\/p>\n

Parent-Aware Guidance<\/b><\/h3>\n

Other interface-based vulnerability remediation tools include GitHub\u2019s <\/span>Dependabot<\/span><\/a>, The Node Package Manager\u2019s <\/span>npm audit<\/span><\/a>, Google\u2019s <\/span>OSV-Scanner<\/span><\/a>, <\/span>Snyk CLI<\/span><\/a> and the <\/span>Socket CLI<\/span><\/a>.<\/span><\/p>\n

CVE Lite is smart with the transitive dependencies, pinpointing the exact root level of an errant package.\u00a0<\/span><\/p>\n

\u201cTransitive parent update guidance is one of CVE Lite CLI\u2019s core differentiators,\u201d the <\/span>documentation claims<\/span><\/a>. \u201cInstead of telling users to install a vulnerable transitive package directly, the CLI points at the parent package that controls the dependency path.\u201d<\/span><\/p>\n

A direct dependency is easy to replace. Transitive dependencies, or dependencies embedded within other dependencies, are trickier to sort out.\u00a0<\/span><\/p>\n

But CVE Lite is smart enough to know when the package is transitive. A lot of package managers, if they can\u2019t find the embedded package, or if the parent package prevents it from updating the problematic dependency, will just put the new version of the embedded dependency in the root directory, which is effectively useless.\u00a0<\/span><\/p>\n

CVE Lite takes a different approach: Instead of updating the package itself, it updates the parent package.\u00a0<\/span><\/p>\n

CVE Lite CLI can even work with the Node.js Hoist model, where all the packages reside in the node_modules folder, reducing the problem of recursive nesting, though obscuring the dependency tree for most scanners.<\/span><\/p>\n

There are a few immediate limits with this developer-first approach which must be considered in an overall security defense strategy.<\/span><\/p>\n

CVE Lite doesn\u2019t provide any runtime protection, so an organization will need separate tooling for that function. It is wholly dependent on a single CVE database, and thus may miss some vulnerabilities that don\u2019t get reported there. The offline cache will continually need to be updated when the software is online.\u00a0<\/span><\/p>\n

The Problem of Vendoring<\/b><\/h3>\n

Hidden dependencies remain a quagmire for the open source community in general, especially as unpatched vulnerabilities are the major source of supply chain attacks \u2013 witness the <\/span>Mini Shai-Hulud attack<\/span><\/a> earlier this month in which 170 npm and PyPI packages were poisoned.\u00a0<\/span><\/p>\n

A user may install an app that comes with its own set of dependencies. Unless the app itself is updated (if it is updated at all), it may contain libraries or other code that will have known vulnerabilities. This is sometimes called \u201c<\/span>vendoring<\/span><\/a>,\u201d where a software provider introduces hidden vulnerabilities through third-party software.\u00a0\u00a0\u00a0\u00a0<\/span><\/p>\n

Mitchell Hashimoto, creator of the popular Ghostty terminal, recommends forking any dependencies you use, trimming them to just what you need, and then embed them in your code and never update them, at least until something breaks.\u00a0<\/span><\/p>\n

\u201cI\u2019ve always said that updating is way riskier than latent bugs (which can be tracked and CVEs monitored),\u201d he <\/span>wrote on X<\/span><\/a>. \u201cIf you are updating a dependency, it\u2019s on you to analyze every single commit in the full transitive set of dependencies.\u201d<\/span><\/p>\n

Read More<\/a><\/p>\n

\u200b<\/p>","protected":false},"excerpt":{"rendered":"

Checking for dependency vulnerabilities in freshly developed software is usually done near the end of the build process. Remediation at […]<\/p>\n","protected":false},"author":1,"featured_media":4145,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5],"tags":[],"class_list":["post-4144","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4144","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=4144"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4144\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/4145"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=4144"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=4144"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=4144"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}