Including npm packages in software development projects saves time but can introduce unseen but known vulnerabilities.
CVE Lite CLI is a lightweight command line security scanner that operates on lockfiles during software development. It focuses on JavaScript and Typescript files and is an OSV-powered dependency scanner supporting npm, pnpm and Yarn.
It is an open source tool developed by Sonu Kapoor, now community supported and recently adopted as an OWASP Incubator Project.
Kapoor has been a software developer for 25 years and has experienced and understands all the frustrations and delays in the secure software development process. It is these frustrations and delays that CVE Lite CLI is designed to ease.
“Each project you build doesn’t simply contain your own code. It pulls in hundreds of open source packages. Each of those packages might pull in other packages with their own dependencies, until a typical JavaScript project might involve thousands of these dependencies,” he explains.
The developer has probably never heard of the majority and doesn’t know how they got included. At this stage the developer is flying blind. “Any one of those packages could have a known security vulnerability – and most developers have no idea it’s there.”
SBOMs were introduced to solve this problem, especially within OSS. In theory, they should solve this problem; but SBOMs cannot be trusted, especially within OSS. Developers must use scanners to locate vulnerabilities in unknown but automatically included npm packages. Scanners exist, but they can often only be used at a non-optimal time, and do not provide fully optimal assistance.
“CVE Lite CLI is a free, open-source command line tool that scans your projects in seconds and tells you exactly which included packages contain a vulnerability. But it doesn’t just tell you what is broken – it tells you how to fix it: it is not simply a huge log or list of warnings,” he continues. “It uses its own internal algorithm to analyze any vulnerable dependency and provide the safest command to include an alternative non-vulnerable package that won’t break the application.”
The tool allows the developer to produce secure code as part of the process of coding.
Today, much coding is done with the assistance of an AI coding agent. An alternative approach would be to allow the AI to do the scanning; but that produces its own problems even if we ignore the current concern that AI agents are not sufficiently security aware.
“With AI, a scan in the CI is usually the last step that happens after all the other tasks, the npm run build, any linting, unit tests, building an image – and then it runs the CI scan. Depending on how big your project is, this could be a 10 minute thing, but in most enterprise companies I’ve worked in, it takes anywhere between one to two or three hours. And even that depends on an agent being free. So, in CI, if an agent isn’t free, you’re probably waiting another couple of hours before you see the result of the scan.”
So that’s the first issue: time wasted. Few developers have the time to just sit and wait for hours. Most will move on and start the next project – which produces the second issue: loss of context in the first project. Humans are no different to AI agents in this respect. Loss or lack of context can produce bad decisions. The effect of any lack of immediate context surfaces when the developer receives the result of the AI scan.
“Most of these AI scans give you a large log of problems but don’t give you any fixes. They might give you a coarse-grained command, such as ’This package has this CVE: fix it’, but they don’t tell you how to fix it. CVE Lite CLI will give you the command you need to replace the vulnerable npm with a safe npm package.”
The result is a combination of wasted time and increased frustration, all of which could be eliminated by securing the code and its npm or pnpm or Yarn inclusions as they are included during development. Each CVE Lite CLI runs on the developer’s own device, can be used on demand instantly, completes its scan within seconds, and helps fix any discovered vulnerable inclusions.
Needless to say, perhaps, it automatically scans the new npm that its recommended command brings in, ensuring that the proposed fix is a genuine fix. Kapoor cites an example from experience where the developer went through more than 25 separate iterations of seeking a safe alternative to a vulnerable npm package.
“Imagine the frustration,” he says. “You have to install the package. The CI scan says it contains a vulnerability, so you try a different npm. You push it up to CI, you wait for CI to run, and CI says you’re still vulnerable. Okay, so you try the next version. And you go into the same loop again: you push it up, you wait for CI, and it tells you again it’s vulnerable.” Imagine doing this 25 times. That’s a huge and frustrating waste of time.
The biggest problem is when such frustration and time-wasting becomes a hassle. “What can happen then,” he adds, “is that some developers start ignoring the vulnerability out of sheer frustration when they should be fixing it. CVE Lite CLI prevents this by running local scans within seconds, allowing the developer to see the problem, fix the problem, and then move on.”
Related: Supply Chain Attack Hits 32 Red Hat NPM Packages
Related: Software Dependencies Exposed Microsoft, Apple to High-Impact Attacks
Related: Vibe Coding: When Everyone’s a Developer, Who Secures the Code?
Related: Open Source DockSec Uses AI to Cut Through Vulnerability Noise in Docker Images
