Freedom251 › Software Composition Analysis Software
Sandworm Audit
What Sandworm Audit is
Sandworm Audit is a free, open-source Linux command-line tool for checking JavaScript and PHP project dependencies. It scans packages for vulnerabilities, license issues, and metadata problems across npm, Yarn, pnpm, and Composer, including supported workspaces. Findings may include CVEs, license problems, deprecated packages, install scripts, missing repositories, and HTTP, Git, or file dependencies. Reports can be exported as JSON issue and license-usage data, CSV dependency data, and SVG dependency-tree or treemap charts. Users can mark issues resolved and define custom license policies. Configurable conditions can make the command exit with code 1 in CI or Git hook workflows when selected issue types or severities appear. The tool can read package information from custom or private registries configured through npm settings. It requires Node 14.19 or later, a package manifest, and a supported lockfile. Dense graphs may need additional memory or reduced chart depth for visualization.
Who it suits
It suits developers auditing JavaScript or PHP dependencies from a terminal. Teams using CI pipelines or Git hooks can configure failures around selected findings.
What it does well
- Free open-source command-line tool
- Supports npm, Yarn, pnpm, and Composer
- Exports JSON, CSV, and SVG reports
- Custom license policies and resolved issues
- CI and Git hook fail conditions
What to know first
- Linux platform only
- Requires Node 14.19 or later
- Project needs a manifest and supported lockfile
- Dense chart graphs can require substantial memory
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Sandworm Audit | Free and open source command-line tool | Free |
As sandworm.dev lists them, read 11 Oct 2026. The maker's own page has the final word.
Verdict
Sandworm Audit provides dependency, license, and metadata checks without a listed charge. Its command-line and CI controls fit development workflows, while project prerequisites and chart-memory demands should be planned for.
Facts from Sandworm Audit's own pages
- CI integration
- Configurable fail conditions let the command line tool exit with code 1 for selected issue types or severities in CI or Git hook workflows. · docs.sandworm.dev, 11 Oct 2026
- Input requirement
- The application root directory must contain a package manifest and a supported lockfile. · docs.sandworm.dev, 11 Oct 2026
- Intended users
- The homepage describes it for auditing JavaScript and PHP dependencies, with CLI use in terminal, CI, and Git hook workflows. · sandworm.dev, 11 Oct 2026
- Issue coverage
- Detected issues include CVEs, license problems, deprecated packages, install scripts, missing repositories, and HTTP, Git, or file dependencies. · docs.sandworm.dev, 11 Oct 2026
- Issue management
- Users can mark issues as resolved and configure custom license policies. · docs.sandworm.dev, 11 Oct 2026
- Outputs
- It generates JSON issue and license usage reports, CSV dependency data, and SVG dependency tree and treemap visualizations. · docs.sandworm.dev, 11 Oct 2026
- Package managers
- It supports npm, Yarn, pnpm, and Composer. · sandworm.dev, 11 Oct 2026
- Performance limit
- Generating charts for dense dependency graphs can require substantial memory, and the documentation suggests increasing Node memory, reducing chart depth, skipping the tree, or trying another package manager if it runs out of heap. · docs.sandworm.dev, 11 Oct 2026
- Private registries
- It can collect package information from custom or private registries configured through npm settings. · docs.sandworm.dev, 11 Oct 2026
- Purpose
- Sandworm Audit scans a project and its dependencies for vulnerabilities, license issues, and metadata issues. · docs.sandworm.dev, 11 Oct 2026
- Runtime requirement
- Sandworm Audit requires Node 14.19 or later. · docs.sandworm.dev, 11 Oct 2026
- Support
- The documentation directs support questions and feature requests to GitHub discussions and bug reports to GitHub issues. · docs.sandworm.dev, 11 Oct 2026
- Workspaces
- It supports npm, Yarn, and pnpm workspaces. · github.com, 11 Oct 2026