On the recordRead 11 Oct 202613 facts
lockhawk
Plans and prices
Free
Free
No account · no API key · no usage limits · no per-seat license
Read 11 Oct 2026 · github.com
On the record
- CI integrations
- The repository documents a bundled GitHub Action and CI examples for Azure DevOps and GitLab.github.com · read 11 Oct 2026
- Dashboard
- The standalone HTML dashboard works offline and shows CVSS details, dependency paths, safe versions, and upgrade commands.github.com · read 11 Oct 2026
- How it works
- It reads npm, Yarn, or pnpm lockfiles, builds the full dependency tree, and checks packages against OSV.dev.github.com · read 11 Oct 2026
- License
- Lockhawk is distributed under the MIT license.github.com · read 11 Oct 2026
- Network behavior
- Network failures do not fail a build by default; the strict-network option makes them fail.github.com · read 11 Oct 2026
- Notable limitation
- The repository describes the engine as npm-focused and lists support for more ecosystems as a roadmap item.github.com · read 11 Oct 2026
- Offline use
- The vulnerability database can be cached or downloaded for offline CI scans.github.com · read 11 Oct 2026
- Package managers
- It supports npm lockfiles, Yarn Classic and Berry, and pnpm versions 5, 6, and 9, including workspaces.github.com · read 11 Oct 2026
- Programmatic use
- The repository provides an @lockhawk/core package with a programmatic scan API.github.com · read 11 Oct 2026
- Purpose
- Lockhawk scans npm dependencies for vulnerabilities locally and in CI/CD pipelines.github.com · read 11 Oct 2026
- Reports
- It can output table, JSON, SARIF, JUnit XML, Markdown, or a standalone HTML dashboard.github.com · read 11 Oct 2026
- Scanning details
- The scanner uses OSV range matching, CVSS v3 and v4 scoring, and deduplicates aliased advisories.github.com · read 11 Oct 2026
- Security reporting
- The repository asks users to report vulnerabilities in lockhawk privately rather than opening a public issue.github.com · read 11 Oct 2026
