OWASP Incubator Project Helps Developers Find and Fix Vulnerable Dependencies in Seconds

Including npm packages in software development projects saves time but can introduce unseen but known vulnerabilities. CVE Lite CLI is a lightweight command line security scanner that operates on lockfiles during software development. It focuses on JavaScript and Typescript files and is an OSV-powered dependency scanner supporting npm, pnpm and Yarn. It is an open source tool developed by Sonu Kapoor, now community supported and recently adopted as an OWASP Incubator Project. Kapoor has been a software developer for 25 years and has experienced and understands all the frustrations and delays in the secure software development process. It is these frustrations and delays that CVE Lite CLI is designed to ease. “Each project you build doesn’t simply contain your own code. It pulls in hundreds of open source packages. Each of those packages might pull in other packages with their own dependencies, until a typical JavaScript project might involve thousands of these dependencies,” he explains. The developer has probably never heard of the majority and doesn’t know how they got included. At this stage the developer is flying blind. “Any one of those packages could have a known security vulnerability – and most developers have no idea it’s there.”  SBOMs were introduced to solve this problem, especially within OSS. In theory, they should solve this problem; but SBOMs cannot be trusted, especially within OSS. Developers must use scanners to locate vulnerabilities in unknown but automatically included npm packages. Scanners exist, but they can often only be used at a non-optimal time, and do not provide fully optimal assistance. “CVE Lite CLI is a free, open-source command line tool that scans your projects in seconds and tells you exactly which included packages contain a vulnerability. But it doesn’t just tell you what is broken – it tells you how to fix it: it is not simply a huge log or list of warnings,” he continues. “It uses its own internal algorithm to analyze any vulnerable dependency and provide the safest command to include an alternative non-vulnerable package that won’t break the application.” The tool allows the developer to produce secure code as part of the process of coding.  Today, much coding is done with the assistance of an AI coding agent. An alternative approach would be to allow the AI to do the scanning; but that produces its own problems even if we ignore the current concern that AI agents are not sufficiently security aware. “With AI, a scan in the CI is usually the last step that happens after all the other tasks, the npm run build, any linting, unit tests, building an image – and then it runs the CI scan. Depending on how big your project is, this could be a 10 minute thing, but in most enterprise companies I’ve worked in, it takes anywhere between one to two or three hours. And even that depends on an agent being free. So, in CI, if an agent isn’t free, you’re probably waiting another couple of hours before you see the result of the scan.” So that’s the first issue: time wasted. Few developers have the time to just sit and wait for hours. Most will move on and start the next project – which produces the second issue: loss of context in the first project. Humans are no different to AI agents in this respect. Loss or lack of context can produce bad decisions. The effect of any lack of immediate context surfaces when the developer receives the result of the AI scan. “Most of these AI scans give you a large log of problems but don’t give you any fixes. They might give you a coarse-grained command, such as ’This package has this CVE: fix it’, but they don’t tell you how to fix it. CVE Lite CLI will give you the command you need to replace the vulnerable npm with a safe npm package.” The result is a combination of wasted time and increased frustration, all of which could be eliminated by securing the code and its npm or pnpm or Yarn inclusions as they are included during development. Each CVE Lite CLI runs on the developer’s own device, can be used on demand instantly, completes its scan within seconds, and helps fix any discovered vulnerable inclusions. Needless to say, perhaps, it automatically scans the new npm that its recommended command brings in, ensuring that the proposed fix is a genuine fix. Kapoor cites an example from experience where the developer went through more than 25 separate iterations of seeking a safe alternative to a vulnerable npm package.  “Imagine the frustration,” he says. “You have to install the package. The CI scan says it contains a vulnerability, so you try a different npm. You push it up to CI, you wait for CI to run, and CI says you’re still vulnerable. Okay, so you try the next version. And you go into the same loop again: you push it up, you wait for CI, and it tells you again it’s vulnerable.” Imagine doing this 25 times. That’s a huge and frustrating waste of time. The biggest problem is when such frustration and time-wasting becomes a hassle. “What can happen then,” he adds, “is that some developers start ignoring the vulnerability out of sheer frustration when they should be fixing it. CVE Lite CLI prevents this by running local scans within seconds, allowing the developer to see the problem, fix the problem, and then move on.” Learn More at CodeSecCon – The event that defines how modern applications are built, secured, and maintained in the age of AI. Related: Supply Chain Attack Hits 32 Red Hat NPM Packages Related: Software Dependencies Exposed Microsoft, Apple to High-Impact Attacks Related: Vibe Coding: When Everyone’s a Developer, Who Secures the Code? Related: Open Source DockSec Uses AI to Cut Through Vulnerability Noise in Docker Images WRITTEN BY Kevin Townsend Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines. More from Kevin Townsend Security of 100 AI Agents Tested and Ranked – What You Need to Know Two New Reports Offer Competing Explanations for Cybersecurity’s Growing Crisis Exclusive: How One Line of Code Put Billions of Microsoft Android App Downloads at Risk Russia-Linked ‘GreyVibe’ Attackers Use AI to Supercharge Cyberattacks New Edamame Platform Aims to Catch AI Coding Agents Going Off the Rails The Credential Crisis: How Stolen Credentials Defeat Modern Security ‘SymJack’ Attack Turns AI Coding Agents Into Supply Chain Attack Delivery Systems AppOmni’s Marlin AI Brings Autonomous Investigation to SaaS Security Latest News In Other News: Anthropic Maps AI Threats, Unpatched Comodo Flaw, Palantir Chief Eyed for CISA Hackers Leak DentaQuest Information Impacting 2.6 Million Chrome 149 Patches 429 Vulnerabilities Industry Reactions to New Trump AI Cybersecurity Executive Order: Feedback Friday Five Eyes: Chinese Spies Target Government, Military Staff With Fake Job Opportunities Nightclub Giant RCI Says Data Breach Affects 40,000 Individuals Cisco Warns of 7th SD-WAN Zero-Day Exploited in 2026 Offroad Emerges From Stealth With $7 Million to Tackle Enterprise Identity Risk Trending Webinar: Third-Party Risk In Practice June 4, 2026 Organizations are investing heavily in third-party risk management, but breaches, delays, and blind spots continue to persist. Join this live webinar as we examine the gap between how organizations think their third-party risk programs are performing and what’s actually happening in practice. Register Virtual Roundtable: CISO Forum 2026 Mid-Year Review June 10, 2026 Explore how attackers are using AI to scale threats and how security teams can respond with AI-driven defenses. Protecting against unmonitored use of generative AI (Shadow AI) in business units and building and enforcing AI governance frameworks. Register People on the Move Opal Security has appointed CPO, CTO, VP of Field Engineering, VP of Marketing, and Head of Product and Solutions Marketing. The Department of the Air Force has appointed Ashley Devoto as Chief Information Officer. Bartley Richardson has been named Chief AI and Autonomous Systems Officer at CrowdStrike. More People On The Move Expert Insights The Zero-Knowledge Threat Actor And The End Of Responsible Disclosure AI can help attackers generate malware, create malicious payloads, bypass simple security checks, and convert vague malicious intent into functional code. (Etay Maor) Raising The Cybersecurity Stakes: Ante Up For The Agentic Era CISOs are now facing machine-speed attacks and asking, “How do I agent?” The industry must provide remediation at scale. (Nadir Izrael) Caught Off Guard: Securing AI After It Hits Production As enterprises rush AI projects into production, security teams are increasingly being forced into reactive mode. (Joshua Goldfarb) Cyber Resilience Is The New Business Continuity Plan The organizations best prepared to face disruption are those that align security, continuity and risk management around what the business cannot afford to lose. (Steve Durbin) Enhancing Data Center Security Without Sacrificing Performance For AI data centers, where the stakes are the highest and performance constraints are the tightest, security and performance are no longer a zero-sum game. (Nadir Izrael) Flipboard Reddit Whatsapp Email