pinaka-scan

Free dependency vulnerability scanner. Like Snyk, but open.
Powered by OSV.dev — no API key, no signup, no limits.

Install

pip install pinaka-scan

Usage

# Auto-detect manifest in current directory
pinaka-scan

# Scan a specific file
pinaka-scan requirements.txt
pinaka-scan package.json
pinaka-scan go.mod

# Verbose output (show descriptions)
pinaka-scan -v

# JSON output (for CI pipelines)
pinaka-scan --json

# Only fail on critical/high severity
pinaka-scan --fail-on high

# Override ecosystem detection
pinaka-scan lockfile.txt -e PyPI

Recursive Scanning

Scan all manifest files in a project tree (monorepos, polyglot repos):

pinaka-scan --recursive
pinaka-scan --recursive -d /path/to/project

Automatically skips node_modules/, .git/, venv/, .venv/ and other junk directories.

SARIF Output

Generate SARIF v2.1.0 output for GitHub Security tab integration:

pinaka-scan --sarif > results.sarif

Ignoring Vulnerabilities

Create a .pinaka-ignore file to suppress accepted vulnerabilities (one ID per line):

# Accepted risk: low severity, no fix available
CVE-2021-34141
GHSA-5cpq-8wj7-hf2v

# Uses .pinaka-ignore by default
pinaka-scan

# Custom ignore file path
pinaka-scan --ignore-file my-ignore-list.txt

Ignored vulnerabilities are excluded from output and do not affect exit codes.

CI/CD Integration

Basic

- name: Scan dependencies
  run: |
    pip install pinaka-scan
    pinaka-scan --fail-on high

GitHub Security Tab (SARIF)

Upload scan results to the GitHub Security tab:

- name: Scan dependencies
  run: |
    pip install pinaka-scan
    pinaka-scan --sarif > results.sarif
  continue-on-error: true

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Exit codes:

• 0 — no vulnerabilities (or none above --fail-on threshold)
• 1 — vulnerabilities found
• 2 — scan error

Supported Ecosystems

How It Works

1. Reads your dependency manifest
2. Parses package names + versions
3. Batch-queries OSV.dev (Google's open vulnerability database)
4. Displays results with severity, CVE IDs, and fix versions

No data is stored. No telemetry. Runs entirely on your machine.

All Flags

Built by

Parth Shukla

License

MIT