Sandworm Audit

What it does

CI integration

Configurable fail conditions let the command line tool exit with code 1 for selected issue types or severities in CI or Git hook workflows.checked 11 Oct 2026

Input requirement

The application root directory must contain a package manifest and a supported lockfile.checked 11 Oct 2026

Intended users

The homepage describes it for auditing JavaScript and PHP dependencies, with CLI use in terminal, CI, and Git hook workflows.checked 11 Oct 2026

Issue coverage

Detected issues include CVEs, license problems, deprecated packages, install scripts, missing repositories, and HTTP, Git, or file dependencies.checked 11 Oct 2026

Issue management

Users can mark issues as resolved and configure custom license policies.checked 11 Oct 2026

Outputs

It generates JSON issue and license usage reports, CSV dependency data, and SVG dependency tree and treemap visualizations.checked 11 Oct 2026

Package managers

It supports npm, Yarn, pnpm, and Composer.checked 11 Oct 2026

Performance limit

Generating charts for dense dependency graphs can require substantial memory, and the documentation suggests increasing Node memory, reducing chart depth, skipping the tree, or trying another package manager if it runs out of heap.checked 11 Oct 2026

Private registries

It can collect package information from custom or private registries configured through npm settings.checked 11 Oct 2026

Purpose

Sandworm Audit scans a project and its dependencies for vulnerabilities, license issues, and metadata issues.checked 11 Oct 2026

Runtime requirement

Sandworm Audit requires Node 14.19 or later.checked 11 Oct 2026

Support

The documentation directs support questions and feature requests to GitHub discussions and bug reports to GitHub issues.checked 11 Oct 2026

Workspaces

It supports npm, Yarn, and pnpm workspaces.checked 11 Oct 2026