cve-watch scans your Node.js projects for security risks. It checks your project files against a massive database of known vulnerabilities. You do not need to log in or create an account to use it. The program runs as a single file on your computer.
Your computer must meet these basic needs:
- Operating System: Windows 10 or Windows 11.
- Processor: Any standard multi-core processor.
- Memory: At least 2GB of RAM.
- Storage: 50MB of free space for the tool.
- Network: An internet connection is necessary to fetch the latest security data.
You can find the software on the official GitHub releases page. Follow these steps to obtain the correct file:
- Visit this page to download.
- Look for the section labeled "Latest."
- Click the link that ends in ".exe" to begin the download.
- Save the file to your desktop or your downloads folder.
The software is a standalone tool. You do not need to install it. Once the download finishes, the program is ready for use.
The program works through your command prompt. Follow these instructions to scan your project:
- Right-click the folder containing your Node.js project.
- Select "Open in Terminal" or "Open PowerShell window here."
- If you placed the cve-watch file on your desktop, type the full path to the file followed by the current folder shortcut. For example, type
C:\Users\Name\Desktop\cve-watch.exe .and press Enter. - The scanner checks your
package-lock.jsonfile. - It compares your project dependencies against the OSV.dev security database.
- The terminal window displays the results of the scan.
The scanner provides a list of findings after it finishes the check.
- No Vulnerabilities found: Your project contains no known risks based on the current data.
- Vulnerability found: The tool lists the specific library causing the risk. It shows the name of the package and a brief description of the flaw.
- Severity Rating: The tool labels issues as Low, Medium, High, or Critical. Prioritize fixing Critical and High issues first.
- Fix Guidance: The terminal shows which version of the dependency has the fix for the problem. Update your project to resolve the listed security risk.
You can add this tool to your automated build process. If you use a deployment pipeline, add a step to run this binary. Configure your pipeline to fail the build if the scan detects a vulnerability with a score above a specific level. This keeps your production environment safe from known supply-chain risks.
Does the tool upload my code? No. The tool only sends the names and versions of your project dependencies to the security database. It does not read or send your source code.
Do I need an API key? No. This tool requires no accounts, keys, or logins.
How often should I scan? Run the tool every time you add a new dependency to your project. Regular checks ensure you catch new vulnerabilities as they become public.
Does this tool fix the bugs? No. The tool alerts you to the presence of security risks. You must manually update your package version to apply the patch.
What happens if I receive a false positive? Security databases sometimes include entries that do not affect your specific configuration. Review the linked security report provided by the tool to see if your code uses the vulnerable function. If the code does not use the function, you can choose to ignore the finding while you plan your update.
Can I run the scan on multiple folders?
Yes. You can run the command in any folder that contains a package-lock.json file. Each project requires a separate scan execution.
Does this tool work offline? No. It requires a connection to the internet to reach the OSV.dev database. The database updates constantly as new security flaws appear. An offline scan would be outdated and ineffective.
Keep your project dependencies updated. A scanner identifies risks, but updates provide the defense. Use the scan results to plan your maintenance schedule. Check your dependencies at least once per month even if you do not add new packages. Many vulnerabilities appear in older, stable libraries. By staying proactive, you minimize your risk of supply-chain attacks.