Skip to content
THREATWIRE

OSV-Scanner

Dependency scanner backed by the OSV database

Google's vulnerability scanner that reads lockfiles, SBOMs and container images and checks the packages against the open OSV.dev database.

Open sourceApache-2.0
Alternative toSnykSonatype Lifecycle
Visit website View repository Docs
Homepage of OSV-Scanner
Official website (google.github.io), captured by ThreatWire.

What OSV-Scanner does

OSV-Scanner finds the dependencies of a project from lockfiles, manifests, SBOMs or container images and queries OSV.dev, an open vulnerability database that aggregates advisories from many ecosystems. Because OSV uses precise affected version ranges, results tend to be specific.

It also offers guided remediation for some ecosystems, offline scanning and call analysis to flag only vulnerable functions that are actually reachable in supported languages.

Key features

  • Lockfile, SBOM and container image scanning
  • Backed by the OSV.dev open database
  • Offline mode with local database
  • Call analysis for some languages
  • Guided remediation for npm and Maven

Licence

Apache-2.0 · Apache License 2.0 · Open source

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.

Security of OSV-Scanner itself

No published advisory found for OSV-Scanner in GitHub repository advisories and OSV.dev. That does not mean the tool has no vulnerabilities.

Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.

Categories and tags

Dependencies and SBOM (SCA)#osv#lockfiles#go#sca#scanner#security-audit#security-tools#vulnerability-scanner

Related tools

  • Grype

    Vulnerability scanner for images, file systems and SBOMs

    Anchore's vulnerability scanner for container images, file systems and SBOMs, matching packages against a regularly updated vulnerability database.

    Stars
    13k
    Forks
    920
    Last commit
    today
    Apache-2.0Open sourceDependencies and SBOM (SCA)
    Alternative toSnykSonatype Lifecycle

  • Syft

    SBOM generator for images and file systems

    CLI tool and Go library from Anchore that generates a software bill of materials from container images and file systems in SPDX and CycloneDX formats.

    Stars
    9.7k
    Forks
    1k
    Last commit
    today
    Apache-2.0Open sourceDependencies and SBOM (SCA)
    Alternative toSonatype LifecycleSnyk

  • Trivy

    All-in-one scanner for images, code, IaC and clusters

    Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.

    Stars
    39k
    Forks
    776
    Last commit
    today
    Apache-2.0Open sourceContainer and Kubernetes security
    Alternative toSnykPrisma Cloud+1

  • Checkov

    Static analysis for infrastructure as code

    Policy-as-code scanner for Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and more, with graph-based checks across resources.

    Stars
    9.1k
    Forks
    1.4k
    Last commit
    6 days ago
    Apache-2.0Open sourceCloud and IaC security
    Alternative toPrisma CloudWiz+1

Related on ThreatWire

Share on X@threatwire_https://www.threatwire.tech/tools/osv-scanner