pinaka-scan 0.2.0

Free dependency vulnerability scanner. Like Snyk, but open. Powered by OSV.dev.

pinaka-scan

Free dependency vulnerability scanner. Like Snyk, but open.
Powered by OSV.dev — no API key, no signup, no limits.

Install

pip install pinaka-scan

Usage

# Auto-detect manifest in current directory
pinaka-scan

# Scan a specific file
pinaka-scan requirements.txt
pinaka-scan package.json
pinaka-scan go.mod

# Verbose output (show descriptions)
pinaka-scan -v

# JSON output (for CI pipelines)
pinaka-scan --json

# Only fail on critical/high severity
pinaka-scan --fail-on high

# Override ecosystem detection
pinaka-scan lockfile.txt -e PyPI

CI/CD Integration

# GitHub Actions
- name: Scan dependencies
  run: |
    pip install pinaka-scan
    pinaka-scan --fail-on high

Exit codes:

• 0 — no vulnerabilities (or none above --fail-on threshold)
• 1 — vulnerabilities found
• 2 — scan error

Supported Ecosystems

Ecosystem	Files
Python (PyPI)	requirements.txt, Pipfile.lock
Node.js (npm)	package.json, package-lock.json, yarn.lock
Go	go.mod, go.sum
Rust (crates.io)	Cargo.toml, Cargo.lock
Ruby (RubyGems)	Gemfile.lock
PHP (Packagist)	composer.json, composer.lock

How It Works

1. Reads your dependency manifest
2. Parses package names + versions
3. Batch-queries OSV.dev (Google's open vulnerability database)
4. Displays results with severity, CVE IDs, and fix versions

No data is stored. No telemetry. Runs entirely on your machine.

Built by

Parth Shukla — also try Pinaka for the web version.

License

MIT