OHRisk
What it is
OHRisk is a free local command-line tool for assessing open-source license risk in software dependencies before a pull request ships. It evaluates dependencies under SaaS or distributed-app usage profiles and labels findings low, review, high, or unknown. Listed inputs cover ecosystems such as npm, Rust, Go, Python, Java, .NET, Ruby, and PHP, along with CycloneDX or SPDX software bills of materials. It can use local package evidence and selected remote evidence sources, with checksum and identity validation for supported ecosystems. Reports can be produced in terminal, JSON, HTML, Markdown, SARIF 2.1.0, or CycloneDX 1.5 JSON formats. A bundled GitHub Actions composite action supports scan, ci, and diff commands, and the guide documents SARIF upload to GitHub code scanning. Local waiver files can prevent selected findings from failing CI thresholds while leaving them visible in reports. OHRisk is an MIT-licensed npm package, also runnable using pnpm, Yarn, or Bun commands; its packaged CLI requires Node.js 24.0.0 or later. The README notes that some dependency sources and graph types are not scanned yet. OHRisk is a risk decision aid, not a substitute for legal review.
For and against
For
- Evaluates dependencies under SaaS or distributed-app profiles.
- Supports multiple report formats, including SARIF.
- Includes a GitHub Actions composite action.
- Local waiver files keep waived findings visible.
- Free and MIT-licensed.
Against
- Requires Node.js 24.0.0 or later.
- Some dependency sources and graph types are not scanned.
- Does not replace legal review.
The verdict
OHRisk can fit dependency review into local and GitHub Actions workflows, with several report formats and visible waivers. Its coverage has stated gaps, and its findings should not be treated as a substitute for legal review.
Who it suits
OHRisk suits developers who want to flag dependency license risks in local workflows or GitHub Actions. It is intended as a decision aid, not a replacement for legal review.
Plans and prices
Ohrisk
Open-source CLI · MIT License
Read 29 Sep 2026 · github.com
On the record
- CI integration
- A bundled GitHub Actions composite action supports scan, ci, and diff commands, and the guide documents SARIF upload to GitHub code scanning.github.com · read 29 Sep 2026
- Dependency coverage
- The README lists supported dependency inputs across ecosystems including npm, Rust, Go, Python, Java, .NET, Ruby, PHP, and CycloneDX or SPDX SBOMs.github.com · read 29 Sep 2026
- Install
- Ohrisk is distributed as an npm package and can also be run using pnpm, Yarn, or Bun package-manager commands.github.com · read 29 Sep 2026
- License
- The repository provides Ohrisk under the MIT License.github.com · read 29 Sep 2026
- License evidence
- Ohrisk can use local package evidence and selected remote evidence sources with checksum and identity validation described for supported ecosystems.github.com · read 29 Sep 2026
- Maker
- The GitHub maker profile is named 0disoft (ZeroDi) and lists Republic of Korea as its location.github.com · read 29 Sep 2026
- Not legal advice
- Ohrisk describes itself as a risk decision aid and says it does not replace legal review.github.com · read 29 Sep 2026
- Outputs
- It can generate terminal, JSON, HTML, Markdown, SARIF 2.1.0, and CycloneDX 1.5 JSON reports.github.com · read 29 Sep 2026
- Purpose
- Ohrisk is a local CLI that catches open-source license risk before a pull request ships.github.com · read 29 Sep 2026
- Risk profiles
- It evaluates dependencies under SaaS or distributed-app usage profiles and reports low, review, high, or unknown findings.github.com · read 29 Sep 2026
- Runtime
- The packaged CLI runs on Node.js version 24.0.0 or later, and users do not need Bun installed.github.com · read 29 Sep 2026
- Scope limitation
- The README states several dependency sources and graph types are not scanned yet, including Gradle graph reconstruction and remote Terraform Registry metadata.github.com · read 29 Sep 2026
- Waivers
- Local waiver files can suppress findings from CI threshold failures while keeping waived findings visible in reports.github.com · read 29 Sep 2026
