Freedom251 › Software Composition Analysis Software
lockhawk
What lockhawk is
lockhawk is a free, MIT-licensed scanner for vulnerabilities in npm dependencies, designed for local use and CI/CD pipelines. It reads npm, Yarn, or pnpm lockfiles, builds the complete dependency tree, and checks packages against OSV.dev. Supported inputs include npm lockfiles, Yarn Classic and Berry, and pnpm versions 5, 6, and 9, including workspaces. Findings can be emitted as tables, JSON, SARIF, JUnit XML, Markdown, or an HTML dashboard that works offline. The dashboard shows CVSS details, dependency paths, safe versions, and upgrade commands. Vulnerability data can be cached or downloaded for offline CI scans. Network failures do not fail builds by default, while strict-network changes that behavior. The scanner uses OSV range matching, CVSS v3 and v4 scoring, and deduplicates aliased advisories. A bundled GitHub Action, Azure DevOps and GitLab examples, and an @lockhawk/core programmatic API are documented. The free plan costs nothing, requires no account or API key, and has no usage or per-seat limits. Lockhawk is npm-focused; broader ecosystems are a roadmap item. It does not generate SBOMs or perform reachability analysis.
Who it suits
lockhawk suits developers and security teams scanning npm, Yarn, or pnpm dependencies locally, in CI/CD, or through self-hosted deployments. It is useful when offline reports and multiple output formats are needed.
What it does well
- Scans npm, Yarn, and pnpm lockfiles
- Supports offline vulnerability data
- Provides multiple report formats
- Includes a GitHub Action
- Free plan has no usage limits
What to know first
- Focused on npm ecosystems
- Additional ecosystems are only a roadmap item
- Does not generate SBOMs
- Does not perform reachability analysis
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Free | No account · no API key · no usage limits · no per-seat license | Free |
As github.com lists them, read 11 Oct 2026. The maker's own page has the final word.
Verdict
lockhawk offers free, self-hosted dependency vulnerability scanning with offline support, CI integrations, and several report formats. Its stated scope centers on npm-related ecosystems, without SBOM generation or reachability analysis.
Facts from lockhawk's own pages
- CI integrations
- The repository documents a bundled GitHub Action and CI examples for Azure DevOps and GitLab. · github.com, 11 Oct 2026
- Dashboard
- The standalone HTML dashboard works offline and shows CVSS details, dependency paths, safe versions, and upgrade commands. · github.com, 11 Oct 2026
- How it works
- It reads npm, Yarn, or pnpm lockfiles, builds the full dependency tree, and checks packages against OSV.dev. · github.com, 11 Oct 2026
- License
- Lockhawk is distributed under the MIT license. · github.com, 11 Oct 2026
- Network behavior
- Network failures do not fail a build by default; the strict-network option makes them fail. · github.com, 11 Oct 2026
- Notable limitation
- The repository describes the engine as npm-focused and lists support for more ecosystems as a roadmap item. · github.com, 11 Oct 2026
- Offline use
- The vulnerability database can be cached or downloaded for offline CI scans. · github.com, 11 Oct 2026
- Package managers
- It supports npm lockfiles, Yarn Classic and Berry, and pnpm versions 5, 6, and 9, including workspaces. · github.com, 11 Oct 2026
- Programmatic use
- The repository provides an @lockhawk/core package with a programmatic scan API. · github.com, 11 Oct 2026
- Purpose
- Lockhawk scans npm dependencies for vulnerabilities locally and in CI/CD pipelines. · github.com, 11 Oct 2026
- Reports
- It can output table, JSON, SARIF, JUnit XML, Markdown, or a standalone HTML dashboard. · github.com, 11 Oct 2026
- Scanning details
- The scanner uses OSV range matching, CVSS v3 and v4 scoring, and deduplicates aliased advisories. · github.com, 11 Oct 2026
- Security reporting
- The repository asks users to report vulnerabilities in lockhawk privately rather than opening a public issue. · github.com, 11 Oct 2026