vulnera icon indicating copy to clipboard operation
vulnera copied to clipboard
verified publisher icon NodeSecure

Implement OSV in the classical Scanner workflow

Open fraxken opened this issue 2 years ago • 1 comments

Add a new strategy / set of API to support the new OpenSSF project OSV: https://osv.dev/

Also see the official GitHub repository: https://github.com/ossf/malicious-packages

fraxken avatar Sep 03 '23 12:09 fraxken

API has been added in #216. The big question now is how can we use in a normal workflow when running a strategy like NPM Audit and then we also want to assert all packages using OSV database?

We probably need to get a list of packages using Arborist and then batch a request to OSV (launching too many request could be a big problem too).

fraxken avatar Jan 26 '24 21:01 fraxken