lockhawk

Spec sheet

Purpose

Lockhawk scans npm dependencies for vulnerabilities locally and in CI/CD pipelines.Read 11 Oct 2026 · github.com

License

Lockhawk is distributed under the MIT license.Read 11 Oct 2026 · github.com

CI integrations

The repository documents a bundled GitHub Action and CI examples for Azure DevOps and GitLab.Read 11 Oct 2026 · github.com

Dashboard

The standalone HTML dashboard works offline and shows CVSS details, dependency paths, safe versions, and upgrade commands.Read 11 Oct 2026 · github.com

How it works

It reads npm, Yarn, or pnpm lockfiles, builds the full dependency tree, and checks packages against OSV.dev.Read 11 Oct 2026 · github.com

Network behavior

Network failures do not fail a build by default; the strict-network option makes them fail.Read 11 Oct 2026 · github.com

Notable limitation

The repository describes the engine as npm-focused and lists support for more ecosystems as a roadmap item.Read 11 Oct 2026 · github.com

Offline use

The vulnerability database can be cached or downloaded for offline CI scans.Read 11 Oct 2026 · github.com

Package managers

It supports npm lockfiles, Yarn Classic and Berry, and pnpm versions 5, 6, and 9, including workspaces.Read 11 Oct 2026 · github.com

Programmatic use

The repository provides an @lockhawk/core package with a programmatic scan API.Read 11 Oct 2026 · github.com

Reports

It can output table, JSON, SARIF, JUnit XML, Markdown, or a standalone HTML dashboard.Read 11 Oct 2026 · github.com

Scanning details

The scanner uses OSV range matching, CVSS v3 and v4 scoring, and deduplicates aliased advisories.Read 11 Oct 2026 · github.com

Security reporting

The repository asks users to report vulnerabilities in lockhawk privately rather than opening a public issue.Read 11 Oct 2026 · github.com

Plans and prices

Every lockhawk plan and price →

Where Specifiction places it

• Software Composition Analysis Software#38 of 657.7