Adoption

Who uses CVE Lite CLI?

CVE Lite CLI is an OWASP Lab Project. Every entry links to the public file that proves it: a workflow, a project script, a hook, or a package manifest. We say what the configuration does, and, where a scan has run in public, we link to that too.

133,000+npm downloads since March 2026
30,712in the last 30 days
51public repositories, across 33 owners

Of those repositories, 26 have public evidence of a scan having run, and 11 publicly record vulnerabilities the scan found and the fixes that followed. A further 4 projects build on, package, or recommend the CLI. Download figures measured on 24 Oct 2026.

Grouped by owner, so a maintainer with several projects appears once. Open any row to see each repository and the file that proves it.

Featured integrations

Established projects and organisations

Larger projects and public-sector teams whose integration is visible in their own repository.

Owner	Projects	How it runs	Status
SolidJS, a JavaScript framework for building user interfaces, with over 36,000 GitHub stars and about 4.9 million npm downloads a week (October 2026). Added by its creator, Ryan Carniato, in his own commit. Runs on every push and pull request to the main branch and every week, and publishes the results to GitHub’s security dashboard.	solid	GitHub Action	Shown running
solidGitHub ActionShown running The dedicated scan workflow has 37 public runs, the most recent on 19 October 2026. .github/workflows/cve-lite.yml Version 5304b338b624e23922c723b284a1b58c0a74f7fa (v1.32.0) · verified 24 Oct 2026
Valibot, a TypeScript schema validation library with about 14 million npm downloads a week (October 2026), and Formisch, a form library from the same team. Both integrations were merged by their creator, Fabian Hiller. Runs in the library’s security workflow and publishes each finding to GitHub’s security dashboard with the exact lockfile line. Developers can also run it locally.	2 projects	GitHub Action	2 of 2 shown running
formischGitHub ActionShown running Runs in the library’s security workflow and publishes each finding to GitHub’s security dashboard with the exact lockfile line. Developers can also run it locally. The security workflow containing the scan has 488 public runs, the most recent on 24 October 2026. Fabian Hiller later improved how the scan publishes its results, in his own pull request. .github/workflows/security.yml Version d747ab87b8eb9df6a2d4e6c7c58fd8d663c2e99c (v1.33.0) · verified 24 Oct 2026 valibotGitHub ActionShown running Runs in the library’s security workflow, blocks on critical vulnerabilities, and publishes the results to GitHub’s security dashboard. Developers can also run it locally. The security workflow containing the scan has 538 public runs, the most recent on 24 October 2026. .github/workflows/security.yml Version d747ab87b8eb9df6a2d4e6c7c58fd8d663c2e99c (v1.33.0) · verified 24 Oct 2026
Waste Plus, a natural resources application of the Government of British Columbia. Runs as a required check on every push and pull request, scanning the application and its end-to-end tests and publishing the results to GitHub’s security dashboard.	nr-waste-plus	CI workflow	Shown running
nr-waste-plusCI workflowShown running The scan jobs ran and passed in 22 of the analysis workflow’s last 30 runs, most recently on 25 October 2026. Runs alongside Trivy and npm audit. .github/workflows/analysis.yml Workflow runs Version 1.25.0 · verified 25 Oct 2026
Réfugiés.info, the French government’s information portal for refugees, run with the Interministerial Delegation for the Reception and Integration of Refugees. Blocks any push while a high or critical vulnerability is present, using a pinned version of the scanner.	2 projects	Git hook	2 of 2 shown running
karfurGit hookShown running Blocks any push while a high or critical vulnerability is present, using a pinned version of the scanner. A merged pull request of 6 October 2026 records a scan sweep across the workspace, the vulnerable transitive dependencies it bumped, and two remaining findings for which no upstream fix was available. Their OSV-Scanner workflow describes CVE Lite CLI as the developer-facing remediation tool that runs alongside it. package.json Version 1.36.1 · verified 24 Oct 2026 playgroundGit hookShown running Blocks any push while a high or critical vulnerability is present, using a pinned version of the scanner. A commit of 21 October 2026 records the pre-push gate failing with one critical and six high findings, and lists the version bumps applied to clear them. package.json Version 1.34.0 · verified 24 Oct 2026
IA dans l’État, the French government’s interministerial artificial-intelligence programme run by DINUM, the state’s digital directorate. Blocks any push while a high or critical vulnerability is present, using a pinned version of the scanner.	2 projects	Git hook	1 of 2 shown running
parcours-ragGit hookShown running Blocks any push while a high or critical vulnerability is present, using a pinned version of the scanner. The merged pull request that added the hook records the override it added to clear the high and critical findings the scan reported. package.json Version 1.18.1 · verified 24 Oct 2026 chat-widgetGit hookConfigured Blocks any push while a high or critical vulnerability is present, using a pinned version of the scanner. The README tells contributors to install the hook. .pre-commit-config.yaml Version 1.39.0 · verified 25 Oct 2026

Community integrations

Teams, open source projects and independent developers

Search by project, maintainer, or what the integration does.

Search projects

Filter by integration

Showing 43 of 43 repositories across 28 owners.

Owner	Projects	How it runs	Status
	etoolbox	Project script	Shown running
etoolboxProject scriptShown running A security check, documented in the README, that fails on high or critical vulnerabilities and tracks accepted findings in a committed baseline. A merged pull request of 22 October 2026 lists each finding and how it was remediated, and a baseline file generated by the tool is committed. package.json Version latest release · verified 24 Oct 2026
	belcoda	Project script	Configured
belcodaProject scriptConfigured A project script that fails on critical vulnerabilities. package.json Version ^1.25.0 · verified 24 Oct 2026
	2 projects	GitHub Action	2 of 2 shown running
research-jsGitHub ActionShown running A weekly automated workflow that scans the project, applies the fixes, and opens a pull request with them. The dedicated fix workflow has 8 public runs, the most recent on 19 October 2026. An automated scan, fix and pull-request workflow. .github/workflows/cve-lite-fix.yml Version @v1 (floating major tag) · verified 24 Oct 2026 Waveshare-WidgetsGitHub ActionShown running An automated workflow that scans the project, applies the fixes, and opens a pull request with them. The dedicated fix workflow has 4 public runs, the most recent on 19 October 2026. An automated scan, fix and pull-request workflow. .github/workflows/cve-lite-fix.yml Version @v1 (floating major tag) · verified 24 Oct 2026
	2 projects	GitHub Action	1 of 2 shown running
boundfoxstudios.comGitHub ActionConfigured Runs in continuous integration and fails the build on critical vulnerabilities. .github/workflows/ci.yml Version fd481fff75f492f94de36dcaf020674af0eca9ef (v1.29.0) · verified 24 Oct 2026 lehrgraphtGitHub ActionShown running Runs in three workflows. The main scan fails on high or critical vulnerabilities and publishes the results to GitHub’s security dashboard. The dedicated scan workflow has 65 public runs, the most recent on 4 October 2026. .github/workflows/cve-check.yml Version @v1 (floating major tag) · verified 24 Oct 2026
	braid	CI workflow	Shown running
braidCI workflowShown running Runs on every pull request, daily, and on demand, failing on high or critical vulnerabilities and on any scan that could not be completed. A baseline file generated by the tool is committed, and the security workflow has 45 public runs, the most recent on 24 October 2026. Kept in a separate audit manifest so the scanner is not a dependency of the published packages. .cve-lite/README.md Version 1.39.0 · verified 24 Oct 2026
	latchgate	GitHub Action	Configured
latchgateGitHub ActionConfigured Runs in continuous integration and from the Makefile, failing on high or critical vulnerabilities in the TypeScript SDK. Listed alongside the project’s other security scanners. .github/workflows/ci.yml Version f2866276b1aaea796ce39550fe98b79a113e4930 (tagged v1 at pin time) · verified 24 Oct 2026
	Isara-Anywhere	Project script	Shown running
Isara-AnywhereProject scriptShown running Scans all five applications of the platform and produces a machine-readable report and an HTML report for each. Report files generated by the tool are committed, including a summary dated 25 June 2026 that records no findings across five scanned applications at a high-severity threshold. A telemedicine platform. Its scanning process is documented in English and Thai. scripts/security/run-cve-lite-scan.mjs verified 24 Oct 2026
	8 projects	Project script	Configured
birthdaybotProject scriptConfigured A security script that checks for vulnerabilities, unsafe dependency overrides, and unmaintained packages. package.json verified 24 Oct 2026 configProject scriptConfigured A security script that checks the production dependencies the project imports for vulnerabilities, unsafe dependency overrides, and unmaintained packages. Fails on critical findings, the CLI’s default threshold. package.json verified 24 Oct 2026 distractionbotProject scriptConfigured A security script that checks for vulnerabilities, unsafe dependency overrides, and unmaintained packages. package.json verified 24 Oct 2026 dropzonebotProject scriptConfigured A security script that checks for vulnerabilities, unsafe dependency overrides, and unmaintained packages. package.json verified 24 Oct 2026 quotesbotProject scriptConfigured A security script that checks for vulnerabilities, unsafe dependency overrides, and unmaintained packages. package.json verified 24 Oct 2026 randomwordbotProject scriptConfigured A security script that checks for vulnerabilities, unsafe dependency overrides, and unmaintained packages. package.json verified 24 Oct 2026 soberProject scriptConfigured A security script that checks the production dependencies the project imports for vulnerabilities, unsafe dependency overrides, and unmaintained packages. frontend/package.json verified 24 Oct 2026 wordjumblebotProject scriptConfigured A security script that checks for vulnerabilities, unsafe dependency overrides, and unmaintained packages. package.json verified 24 Oct 2026
	rotv	GitHub Action	Shown running
rotvGitHub ActionShown running A required check on every pull request across all three parts of the project, failing on high or critical vulnerabilities. Full results go to GitHub’s security dashboard. A merged pull request of 24 October 2026 records new advisories turning the required scan red and lists the in-range updates applied to clear them. The workflow has 454 public runs, and baseline files generated by the tool are committed. On pull requests it uses the base branch’s baseline, so a pull request cannot accept the findings it introduces. .github/workflows/dependency-scan.yml Version Action v1.40.0 with CLI version: 1.37.0 · verified 24 Oct 2026
	rabik	GitHub Action	Configured
rabikGitHub ActionConfigured Runs in the build pipeline next to Trivy as an advisory scan. Runs as an advisory step alongside Trivy. .github/workflows/build.yml Version @v1 (floating major tag) · verified 24 Oct 2026
	js-regex-security-scanner	CI workflow	Shown running
js-regex-security-scannerCI workflowShown running Runs in continuous integration with a pinned version and a committed baseline of accepted findings. A baseline file generated by the tool is committed, accepting one development-only finding with a reason that links the upstream issue. Makefile Version 1.38.0 · verified 24 Oct 2026
	2 projects	Project script	Configured
LogviewRProject scriptConfigured Two security scripts: one fails on critical vulnerabilities, a strict one on high or critical. package.json verified 24 Oct 2026 MynetworKProject scriptConfigured Two security scripts: one fails on critical vulnerabilities, a strict one on high or critical. package.json verified 24 Oct 2026
	3 projects	GitHub Action	Configured
node-check-package-lockGitHub ActionConfigured Runs in continuous integration and fails the build on critical vulnerabilities. .github/workflows/ci.yml Version 32c21bb9c73050bc177b563633b3fe684825517c (v1.28.0) · verified 24 Oct 2026 node-css-image-checkerGitHub ActionConfigured Runs in continuous integration and fails the build on critical vulnerabilities. .github/workflows/ci.yml Version 32c21bb9c73050bc177b563633b3fe684825517c (v1.28.0) · verified 24 Oct 2026 node-has-exif-cliGitHub ActionConfigured Runs in continuous integration and fails the build on critical vulnerabilities. .github/workflows/ci.yml Version 32c21bb9c73050bc177b563633b3fe684825517c (v1.28.0) · verified 24 Oct 2026
	rustashop	CI workflow	Shown running
rustashopCI workflowShown running Three continuous-integration jobs run npm audit and then the scanner, failing on high or critical vulnerabilities. A merged pull request of 23 October 2026 records a high finding failing the supply-chain check and the version override applied to clear it. The pipeline has 557 public runs. .github/workflows/ci.yml Version 1.33.0 · verified 24 Oct 2026
	agent-mods	Git hook	Configured
agent-modsGit hookConfigured A pre-push hook scans every package in the workspace and blocks a push on high or critical vulnerabilities. .husky/pre-push Version 1.19.2 · verified 24 Oct 2026
	angular-typechecker	CI workflow	Shown running
angular-typecheckerCI workflowShown running A required merge check that fails on medium or higher vulnerabilities, with a committed baseline of accepted findings. A baseline file generated by the tool is committed with three accepted development-only findings, and the project’s own verification notes record the scan passing with those findings suppressed. The repository also ships a purpose-built AI-assistant skill documenting the tool. package.json Version 1.27.0 · verified 24 Oct 2026
	react-markdown-composer	Project script	Shown running
react-markdown-composerProject scriptShown running A security check, documented in the README, that fails on high or critical vulnerabilities and tracks accepted findings in a committed baseline. A merged pull request of 22 October 2026 lists the findings by package and severity and what was done with each, and a baseline file generated by the tool is committed. package.json Version latest release · verified 24 Oct 2026
	github-action	GitHub Action	Configured
github-actionGitHub ActionConfigured Runs in continuous integration and fails the build on medium or higher vulnerabilities. Pinned to a commit SHA. .github/workflows/build.yml Version 32c21bb9c73050bc177b563633b3fe684825517c (v1.28.0) · verified 24 Oct 2026
	4 projects	Project script, Git hook	2 of 4 shown running
configProject scriptConfigured A security script, shared across the maintainer’s projects, that fails on high or critical vulnerabilities. package.json Version declared as catalog: (resolved version not visible in the manifest) · verified 24 Oct 2026 itsb-webProject scriptShown running A pre-push hook runs the security script before every push, failing on high or critical vulnerabilities and on unsafe dependency overrides. The maintainer’s merged pull request of 24 October 2026 records the scan failing on high-severity advisories in zod and undici, the upgrades and the override applied to clear them, and the rescan reporting no known vulnerabilities and no override-hygiene issues. package.json Pull request #666 Version ^1.40.0 · verified 25 Oct 2026 kurze-urlProject scriptConfigured A security script that fails on high or critical vulnerabilities. package.json Version declared as catalog: · verified 24 Oct 2026 tsg-irlich-webGit hookShown running A pre-push hook scans before every push, and a project script fails on high or critical vulnerabilities. The maintainer’s merged pull request of 24 October 2026 lists five in-range lockfile updates made to clear findings the scan reported, including a critical dompurify advisory, and records the rescan leaving one finding, zod 3.25.76, which has no fixed 3.x release. The pre-push hook blocks a push on critical findings, the CLI’s default threshold, and the project script fails on high or critical. lefthook.yml Pull request #660 Version ^1.40.0 (pnpm catalog) · verified 25 Oct 2026
	solid-material	GitHub Action	Shown running
solid-materialGitHub ActionShown running Runs on every push and pull request to the main branch and every week, checks for unmaintained packages as well as vulnerabilities, and publishes the results to GitHub’s security dashboard. The dedicated scan workflow has 88 public runs, the most recent on 19 October 2026. Uses the same workflow as the SolidJS repository. .github/workflows/cve-lite.yml Version 7a064dba76cceef66d6365542256dab179fef1ba (v1.30.0) · verified 24 Oct 2026
	near-chat	CI workflow	Shown running
near-chatCI workflowShown running Runs in continuous integration, publishes results to GitHub’s security dashboard, and fails the build if the baseline of accepted findings is ever removed. A baseline file generated by the tool is committed with one accepted finding. A university course project. .github/workflows/ci-security.yml Version @1 (floating major tag) · verified 24 Oct 2026
	Open-Source-Bazaar.github.io	GitHub Action	Configured
Open-Source-Bazaar.github.ioGitHub ActionConfigured Runs in continuous integration and fails the build on high or critical vulnerabilities. .github/workflows/self-scan.yml Version @v1 (floating major tag) · verified 24 Oct 2026
	crucible-iap	CI workflow	Shown running
crucible-iapCI workflowShown running Runs in continuous integration and fails the build on critical vulnerabilities. The README records a remediation made with the tool: a test-framework upgrade that resolved a published advisory. The scan step ran and passed in the latest pipeline run, on 24 September 2026. .github/workflows/ci.yml Pipeline run Version ^1.19.2 · verified 25 Oct 2026
	fin-bean	Project script	Configured
fin-beanProject scriptConfigured A security script for the frontend, using a pinned version, that fails on critical vulnerabilities. Fails on critical findings, the CLI’s default threshold. frontend/package.json Version 1.26.0 · verified 24 Oct 2026
	auto-opsi-repo	GitHub Action	Shown running
auto-opsi-repoGitHub ActionShown running A scheduled automated workflow that scans the project, applies the fixes, and opens a pull request with them. The dedicated fix workflow has 44 public runs, the most recent on 24 October 2026. An automated scan, fix and pull-request workflow. .github/workflows/cve-lite-fix.yml Version 8ba9e5e6e6e8a4d71b15f4ca82fe09f692b3e5fb (v1.38.0) · verified 24 Oct 2026
	shiftoryx	CI workflow	Shown running
shiftoryxCI workflowShown running A security script and a pipeline gate that fail on high or critical vulnerabilities. The CVE Lite high and critical gate ran and passed in a security workflow run of 9 October 2026. Runs alongside Trivy, Semgrep and Dependabot. package.json Workflow run Version @1 (floating major tag) · verified 25 Oct 2026
	stevefenton.co.uk	Project script	Configured
stevefenton.co.ukProject scriptConfigured A security script that fails on critical vulnerabilities. Fails on critical findings, the CLI’s default threshold. package.json Version ^1.39.0 · verified 24 Oct 2026
	OpenSesame	Project script	Shown running
OpenSesameProject scriptShown running A security gate that fails on any vulnerability and on unsafe dependency overrides, and checks the results of both scans. Two committed audit records report the results of a scan and an override audit, and list the override and phantom-dependency findings that were then fixed. scripts/audit/cve-lite-gate.sh verified 24 Oct 2026

Recommendations and distribution

Built on, packaged with, and recommending CVE Lite CLI

Products that use the CLI as their scanning engine, distributions that package it for another platform, and guidance that recommends it.

Owner	Projects	How it runs	Status
A product that runs the CLI from its own server routes and parses the JSON output into its data model, exposing a dashboard, the fix and override-fix commands, advisory database sync, and the HTML report.	hexops	Embedded in another tool	Shown running
hexopsEmbedded in another toolShown running Captured JSON output from the CLI is committed as test fixtures, with unit tests that parse it. A product that uses the CLI as its scanning engine. src/lib/security/sources/cve-lite.ts Version 1.29.0 · verified 24 Oct 2026
Packages the CLI as a Nix derivation built from the published release tarball, with a test asserting the packaged version matches and a script that tracks the latest release.	flakes	Packaging	Shown running
flakesPackagingShown running A build-time test runs the packaged binary, so every successful build has executed it. Makes the CLI installable through Nix. pkgs/cve-lite-cli/package.nix verified 24 Oct 2026
A published guidance skill that recommends the CLI for JavaScript and TypeScript supply-chain work, covering OSV matching, copy-and-run remediation, the offline advisory database, and SARIF output for Code Scanning.	skills	Recommendation	Configured
skillsRecommendationConfigured A security skill for AI coding agents. skills/supply-chain-security/references/patterns.md verified 24 Oct 2026
A security platform that ships a dedicated scanner container wrapping the CLI, feeds the packages and vulnerabilities it reports into its own dependency API, and offers continuous-integration gates on severity, known-exploited status and exploitation likelihood.	warden	Embedded in another tool	Configured
wardenEmbedded in another toolConfigured A product that uses the CLI as its scanning engine. docs/security-integration/sca/cve-lite.md Version 1.19.2 (Dockerfile ARG default) · verified 24 Oct 2026

We list only what is publicly visible in a repository. Private deployments are never published without permission.