lockhawk

What it does

CI integrations

The repository documents a bundled GitHub Action and CI examples for Azure DevOps and GitLab.checked 11 Oct 2026

Dashboard

The standalone HTML dashboard works offline and shows CVSS details, dependency paths, safe versions, and upgrade commands.checked 11 Oct 2026

How it works

It reads npm, Yarn, or pnpm lockfiles, builds the full dependency tree, and checks packages against OSV.dev.checked 11 Oct 2026

License

Lockhawk is distributed under the MIT license.checked 11 Oct 2026

Network behavior

Network failures do not fail a build by default; the strict-network option makes them fail.checked 11 Oct 2026

Notable limitation

The repository describes the engine as npm-focused and lists support for more ecosystems as a roadmap item.checked 11 Oct 2026

Offline use

The vulnerability database can be cached or downloaded for offline CI scans.checked 11 Oct 2026

Package managers

It supports npm lockfiles, Yarn Classic and Berry, and pnpm versions 5, 6, and 9, including workspaces.checked 11 Oct 2026

Programmatic use

The repository provides an @lockhawk/core package with a programmatic scan API.checked 11 Oct 2026

Purpose

Lockhawk scans npm dependencies for vulnerabilities locally and in CI/CD pipelines.checked 11 Oct 2026

Reports

It can output table, JSON, SARIF, JUnit XML, Markdown, or a standalone HTML dashboard.checked 11 Oct 2026

Scanning details

The scanner uses OSV range matching, CVSS v3 and v4 scoring, and deduplicates aliased advisories.checked 11 Oct 2026

Security reporting

The repository asks users to report vulnerabilities in lockhawk privately rather than opening a public issue.checked 11 Oct 2026