Skill: moenassi/osv-scanner (version 1.0.0)

## IMPORTANT !!!! change ScanResult file extension from txt -> xlsx located in template ## 🔍 NPM & Node.js Vulnerability Scanner (OSV API) A lightweight tool that scans your Node.js/NPM dependencies and Linux Packages for known vulnerabilities by using the **Google OSV API**. It reads your project packages and instantly returns any related CVEs. ### 🧠 How It Works 1. Reads `packages/package.json` / `packages/package.txt` 2. Collects all dependency names and versions 3. Sends them to the **OSV API** 4. Receives and displays any vulnerabilities (CVEs) affecting those packages **Linux** - python3 -m venv .venv - pip install requests openpyxl - source .venv/bin/activate - copy packages.json to /packages folder and name it exactly like this 'packages.json' for nodejs otherwise for python use this command: - pip freeze > packages.txt - python3 scanner.py npm **Windows** - python3 -m venv .venv - pip install requests openpyxl - ./.venv/Script/Activate.ps1 - copy packages.json to /packages folder and name it exactly like this 'packages.json' for nodejs otherwise for python use this command: - pip freeze > packages.txt - python3 scanner.py npm

path: README.md
content: ## IMPORTANT !!!!
change ScanResult file extension from txt -> xlsx located in template

## 🔍 NPM & Node.js Vulnerability Scanner (OSV API)

A lightweight tool that scans your Node.js/NPM dependencies and Linux Packages for known vulnerabilities by using the **Google OSV API**. It reads your project packages and instantly returns any related CVEs.

### 🧠 How It Works
1. Reads `packages/package.json` / `packages/package.txt`
2. Collects all dependency names and versions
3. Sends them to the **OSV API**
4. Receives and displays any vulnerabilities (CVEs) affecting those packages

**Linux**

    - python3 -m venv .venv
    - pip install requests openpyxl
    - source .venv/bin/activate
    - copy packages.json to /packages folder and name it exactly like this 'packages.json' for nodejs otherwise for python use this command:
        - pip freeze > packages.txt
    - python3 scanner.py npm

**Windows**

    - python3 -m venv .venv
    - pip install requests openpyxl
    - ./.venv/Script/Activate.ps1
    - copy packages.json to /packages folder and name it exactly like this 'packages.json' for nodejs otherwise for python use this command:
        - pip freeze > packages.txt
    - python3 scanner.py npm


path: scanner.py
content: import requests, shutil, sys, json, subprocess, datetime
from openpyxl import load_workbook 
from concurrent.futures import ThreadPoolExecutor, as_completed

TEMPLATE_PATH = "template/ScanResult.xlsx"

NEW_FILE = f'ScanResult_{datetime.date.today()}.xlsx'

def getCVEversion(name, version, ecosystem):
    url = 'https://api.osv.dev/v1/query'
    payload = {
        "version": version,
        "package": {
            "name": name,
            "ecosystem": ecosystem
        }
    }
    res = requests.post(url, json=payload).json()
    
    if 'vulns' in res:
        return res['vulns']
    return None

if sys.argv.__len__() == 1:
    print('Please add the packages language !\n\033[31mUsage\033[0m:\n\t\033[33mpython3 ./scanner.py [eg: npm, python, os]\033[0m')
    exit()
program = sys.argv[1].lower()
lines = []
all_rows = []

if program == 'centos':
    with open('packages/packages-lin.txt', 'r') as file:
        lines = file.readlines()
    eco = 'Red Hat'
elif program == 'os':
    result = subprocess.run(
        "lsb_release -a | grep 'Distributor ID' | awk '{print $3}'",
        shell=True,
        capture_output=True,
        text=True
    )
    eco = result.stdout.strip()
    operatingSystems = ['debian', 'ubuntu', 'kali']
    if eco.lower() in operatingSystems:
        if eco == 'kali':
            eco = 'Debian'
        result = subprocess.run(
            "dpkg-query -W -f='${binary:Package} ${Version}\n'",
            shell=True,
            capture_output=True,
            text=True
        )
        lines = result.stdout.strip().split('\n')
    else:
        print(f'\033[31mError\033[0m:\n\tYour os \033[35m{eco}\033[0m not in the specified list')
        exit()
elif program == 'npm':
    with open('packages/packages.json', 'r') as file:
        jsonLines = file.readlines()
    line = "".join(jsonLines)
    resp = json.loads(line)
    packages = resp['dependencies']
    for name, version in packages.items():
        lines.append(f'{name}=={version.split('^')[1]}')
    eco = 'npm'
elif program == 'python':
    with open('packages/packages.txt', 'r') as file:
        lines = file.readlines()
    eco = 'PyPI'
else:
    print('\033[31mError\033[0m:\n\tPlease choose either \033[30mnpm/python/os\033[0m')
    exit()

def check_package(pkg, eco):
    pkg = pkg.strip()
    if '==' in pkg:
        name, version = pkg.split('==', 1)
    else:
        name, version = pkg.split()

    vulns = getCVEversion(name, version, eco)
    return name, version, vulns

def print_package_result(name, version, vulns):
    print(f'\033[34mPackage\033[0m: {name} {version}')
    if not vulns:
        print('\033[34m\tStatus\033[0m: Package is up to date')
    else:
        rows = []
        for vuln in vulns:
            # if eco == 'centos':
            upstream = vuln.get('id')
            # cves = [a for a in upstream if a.startswith("CVE-")]
            # if eco == 'PyPI':
            #     aliases = vuln.get('aliases', [])
            #     cves = [a for a in aliases if a.startswith("CVE-")]
        if upstream:
            print(f'\033[34m\tCVE\033[0m: \033[31m⚠ {upstream} \033[0m')
            rows.append({
                'MachineA': f'{name} - {version} - {upstream}'
            })
            return rows
        return None

max_workers = 20

with ThreadPoolExecutor(max_workers=max_workers) as executor:
    future_to_pkg = {
        executor.submit(check_package, line, eco): line 
        for line in lines
    }
    
    for future in as_completed(future_to_pkg):
        try:
            name, version, vulns = future.result()
            row = print_package_result(name, version, vulns)
            if row:
                all_rows.extend(row)
        except Exception as e:
            print(f'\033[31mError\033[0m: {e}')

if all_rows:
    shutil.copy(TEMPLATE_PATH, NEW_FILE)

    wb = load_workbook(NEW_FILE)
    ws = wb.active
    
    machine_col = None
    for col in range(1, ws.max_column + 1):
        if ws.cell(row=1, column=col).value == "MachineA":
            machine_col = col
            break
    
    if machine_col is None:
        raise Exception("Header 'MachineA' not found in template")
    
    row_index = 2
    while ws.cell(row=row_index, column=machine_col).value is not None:
        row_index += 1
    
    for row_data in all_rows:
        ws.cell(row=row_index, column=machine_col, value=row_data['MachineA'])
        row_index += 1

    wb.save(NEW_FILE)

path: packages/packages-lin.txt
content: expat==2.1.0
ncurses-base==5.9
cpio==2.11
libICE==1.0.9
nss-sysinit==3.53.1
dejavu-fonts-common==2.33
file-libs==5.11
pixman==0.34.0
basesystem==10.0
iproute==4.11.0
python-lxml==3.2.1
glib2==2.56.1
kernel==3.10.0
libcroco==0.6.12
libwayland-client==1.15.0
libattr==2.4.46
python2-psutil==5.7.2
pcre==8.32
python2-beautifulsoup4==4.6.3
lksctp-tools==1.0.17
p11-kit==0.23.5
python-urlgrabber==3.10
libXext==1.3.3
libtasn1==4.10
nss-tools==3.53.1
libXdamage==1.1.4
mariadb-libs==5.5.68
libXtst==1.2.3
ivtv-firmware==20080701
acl==2.2.51
libXinerama==1.1.3
rootfiles==8.1
tomcat-lib==7.0.76
giflib==4.1.6
libgcrypt==1.5.3
libteam==1.29
pango==1.42.4
gzip==1.5
curl==7.29.0
xorg-x11-fonts-Type1==7.5
rpm-build-libs==4.11.3
gtk2==2.24.31
cracklib==2.9.0
kernel-tools-libs==3.10.0
geronimo-jms==1.1.1
util-linux==2.23.2
xerces-j2==2.11.0
zlib==1.2.7
libtool-ltdl==2.4.2
kmod==20
avalon-framework==4.3
cracklib-dicts==2.9.0
systemd-libs==219
geronimo-jta==1.1.1
elfutils-default-yama-scope==0.176
jakarta-taglibs-standard==1.1.2
libassuan==2.1.0
grub2-tools==2.02
zip==3.0
groff-base==1.22.2
NetworkManager==1.18.8
flac-libs==1.3.0
libunistring==0.9.3
dhclient==4.2.5
gsm==1.0.13
tcp_wrappers-libs==7.6
device-mapper-event==1.02.170
newt==0.52.15
teamd==1.29
python-dateutil==1.5
java-1.7.0-openjdk-headless==1.7.0.261
shadow-utils==4.6
python-decorator==3.4.0
plymouth-scripts==0.8.9
python-backports==1.0
subscription-manager-rhsm==1.24.42
python2-tracer==0.7.4
gpg-pubkey==352c64e5
libnetfilter_conntrack==1.0.6
kernel==3.10.0
java-1.8.0-openjdk==1.8.0.272.b10
python-gofer-proton==2.12.5
xmlsec1-openssl==1.2.20
lvm2==2.02.187
python2-argcomplete==1.7.0
NetworkManager-tui==1.18.8
GeoIP==1.5.0
rsyslog==8.24.0
make==3.82
kernel-tools==3.10.0
fuse==2.9.2
mesa-libEGL==18.3.4
libfastjson==0.99.4
mesa-libGL==18.3.4
unzip==6.0
numactl-libs==2.0.12
pinentry==0.8.1
iwl5000-firmware==8.83.5.1_1
iwl135-firmware==18.168.6.1
iwl2030-firmware==18.168.6.1
sqlite==3.7.17
iwl100-firmware==39.31.5.1
ustr==1.0.4
fribidi==1.0.2
openssh-clients==7.4p1
audit==2.8.5
katello-agent==3.5.4
chrony==3.4
katello-ca-consumer-foreman.um6p.local==1.0
python2-qpid==1.37.0
openssl==1.0.2k
alsa-tools-firmware==1.1.0
yum-utils==1.1.31
gobject-introspection==1.56.1
dbus-python==1.1.1
centos-release==7
alsa-lib==1.1.8
tzdata==2020d
libestr==0.1.9
glibc==2.17
chkconfig==1.7.6
sed==4.2.2
libstdc++==4.8.5
pygpgme==0.3
krb5-libs==1.15.1
libjpeg-turbo==1.2.90
elfutils-libelf==0.176
libxshmfence==1.2
libX11==1.6.7
fontpackages-filesystem==1.44
libmount==2.23.2
libwayland-server==1.15.0
libSM==1.2.2
dejavu-sans-fonts==2.33
ncurses==5.9
jasper-libs==1.900.1
filesystem==3.2
libfontenc==1.1.3
libthai==0.1.14
python-javapackages==3.4.1
authconfig==6.2.8
info==5.1
popt==1.13
libxcb==1.13
aic94xx-firmware==30
jbigkit-libs==2.0
pcsc-lite-libs==1.8.8
graphite2==1.3.10
hicolor-icon-theme==0.12
grep==2.20
btrfs-progs==4.9.1
keyutils-libs==1.5.8
libsysfs==2.1.0
libverto==0.2.5
libXrender==0.9.10
p11-kit-trust==0.23.5
libXi==1.7.9
libXcomposite==0.4.4
xz-libs==5.2.2
libXcursor==1.1.15
libXrandr==1.5.1
bzip2-libs==1.0.6
libXxf86vm==1.1.4
libglvnd-glx==1.0.1
libgpg-error==1.12
libglvnd-egl==1.0.1
which==2.20
cairo==1.15.12
gpg-pubkey==f4a80eb5
ttmkfdir==3.0.9
copy-jdk-configs==3.3
kbd-legacy==1.15.5
lua==5.1.4
xml-commons-apis==1.4.01
apache-commons-collections==3.2.1
xalan-j2==2.7.1
libmnl==1.0.3
javamail==1.4.6
audit-libs==2.8.5
pciutils-libs==3.5.1
avalon-logkit==2.1
apache-commons-logging==1.1.2
libdb==5.3.21
apache-commons-daemon==1.0.13
readline==6.2
apache-commons-dbcp==1.4
findutils==4.5.11
libsemanage==2.5
libnl3-cli==3.2.28
cyrus-sasl-lib==2.1.26
net-tools==2.0
libvorbis==1.3.3
ethtool==4.8
libidn==1.28
libdb-utils==5.3.21
libnfnetlink==1.0.1
lzo==2.06
pulseaudio-libs==10.0
slang==2.2.4
python-six==1.9.0
jansson==2.10
gdbm==1.10
python-inotify==0.9.4
libnl==1.1.4
python-ipaddress==1.0.16
pyliblzma==0.5.3
python-backports-ssl_match_hostname==3.5.0.1
newt-python==0.52.15
python-linux-procfs==0.4.11
python-schedutils==0.4
usermode==1.111
grubby==8.28
python-configobj==4.7.2
pyxattr==0.5.1
gpg-pubkey==ef8d349f
nss-pem==1.0.3
gofer==2.12.5
less==458
pkgconfig==0.27.1
python-gobject-base==3.22.0
centos-logos==70.0.6
kernel==3.10.0
fipscheck-lib==1.4.1
python-pycurl==7.19.0
snappy==1.1.0
hardlink==1.0
libicu==50.2
qrencode-libs==3.4.1
libdaemon==0.14
libutempter==1.1.6
polkit-pkla-compat==0.1
iputils==20160308
crontabs==1.11
gpg-pubkey==e0745924
katello-host-tools==3.5.4
katello-host-tools-tracer==3.5.4
puppet-agent==6.19.1
libpciaccess==0.14
qpid-proton-c==0.32.0
pciutils==3.5.1
python-saslwrapper==0.16
alsa-firmware==1.0.28
python2-qpid-proton==0.32.0
ebtables==2.0.10
python-kitchen==1.1.1
dbus-glib==0.100
NessusAgent==8.2.1
python-slip-dbus==0.4.0
grub2-common==2.02
python-pyudev==0.15
tzdata-java==2020d
libX11-common==1.6.7
bash==4.2.46
lsscsi==0.27
glibc-common==2.17
libselinux==2.5
nss-util==3.53.1
libdnet==1.12
libuuid==2.23.2
virt-what==1.18
libcom_err==1.42.9
pth==2.0.7
libacl==2.2.51
libblkid==2.23.2
gpgme==1.3.2
libxml2==2.9.1
nss==3.53.1
mesa-libglapi==18.3.4
freetype==2.8
file==5.11
iptables==1.4.21
libgomp==4.8.5
libffi==3.0.13
shared-mime-info==1.8
python==2.7.5
ca-certificates==2020.2.41
gettext==0.19.8.1
python2-future==0.18.2
python-perf==3.10.0
python-syspurpose==1.24.42
python-dmidecode==3.12.2
atk==2.28.1
mesa-libgbm==18.3.4
device-mapper-persistent-data==0.8.5
libxslt==1.1.28
logrotate==3.8.6
vim-minimal==7.4.629
libss==1.42.9
tomcat-el-2.2-api==7.0.76
libselinux-utils==2.5
bc==1.06.95
libmspack==0.5
libcurl==7.29.0
rpm-libs==4.11.3
openldap==2.4.44
rpm-python==4.11.3
yum==3.4.3
sg3_utils-libs==1.37
procps-ng==3.3.10
kpartx==0.4.9
dracut==033
device-mapper-libs==1.02.170
elfutils-libs==0.176
dbus-libs==1.10.24
dbus==1.10.24
initscripts==9.49.53
grub2-tools-minimal==2.02
polkit==0.112
NetworkManager-libnm==1.18.8
policycoreutils==2.5
dhcp-common==4.2.5
dracut-network==033
grub2-pc==2.02
lvm2-libs==2.02.187
hwdata==0.252
avahi-libs==0.6.31
java-1.8.0-openjdk-headless==1.8.0.272.b10
java-1.7.0-openjdk==1.7.0.261
plymouth-core-libs==0.8.9
plymouth==0.8.9
subscription-manager-rhsm-certificates==1.24.42
firewalld-filesystem==0.6.3
tracer-common==0.7.4
bind-libs-lite==9.11.4
subscription-manager==1.24.42
tomcat-admin-webapps==7.0.76
java-1.7.0-openjdk-devel==1.7.0.261
NetworkManager-team==1.18.8
postfix==2.10.1
grub2==2.02
selinux-policy-targeted==3.13.1
geoipupdate==2.5.0
tuned==2.11.0
microcode_ctl==2.1
parted==3.1
sg3_utils==1.37
ipset==7.1
sudo==1.8.23
libndp==1.2
e2fsprogs==1.42.9
libselinux-python==2.5
gtk-update-icon-cache==3.22.30
libtiff==4.0.3
psmisc==22.20
dmidecode==3.2
libsndfile==1.0.25
setup==2.8.71
iwl4965-firmware==228.61.2.24
iwl6000g2b-firmware==18.168.6.1
iwl2000-firmware==18.168.6.1
iwl6000-firmware==9.221.4.1
iwl1000-firmware==39.31.5.1
iwl7260-firmware==25.30.13.0
iwl3945-firmware==15.32.2.9
iwl6000g2a-firmware==18.168.6.1
wpa_supplicant==2.6
cronie-anacron==1.4.11
openssh-server==7.4p1
iprutils==2.4.17.1
kbd==1.15.5
biosdevname==0.7.3
irqbalance==1.0.7
man-db==2.6.3
pam==1.1.8
libglvnd==1.0.1
nss-softokn==3.53.1
libpng==1.5.13
fontconfig==2.13.0
tomcat-servlet-3.0-api==7.0.76
xorg-x11-font-utils==7.5
lz4==1.8.3
javapackages-tools==3.4.1
ncurses-libs==5.9
python-libs==2.7.5
libXau==1.0.8
gawk==4.0.2
gettext-libs==0.19.8.1
python-firewall==0.6.3
harfbuzz==1.7.5
libxml2-python==2.9.1
gmp==6.0.0
tomcat-jsp-2.2-api==7.0.76
libXfixes==5.0.3
bind-export-libs==9.11.4
gdk-pixbuf2==2.36.12
binutils==2.27
libXft==2.3.2
e2fsprogs-libs==1.42.9
kmod-libs==20
libcap-ng==0.7.5
libssh2==1.8.0
libnl3==3.2.28
rpm==4.11.3
kbd-misc==1.15.5
yum-plugin-fastestmirror==1.1.31
apache-commons-pool==1.6
libsmartcols==2.23.2
xml-commons-resolver==1.2
libsepol==2.5
device-mapper==1.02.170
log4j==1.2.17
xmlsec1==1.2.20
cryptsetup-libs==2.0.3
ecj==4.5.2
libpwquality==1.2.3
systemd==219
diffutils==3.3
device-mapper-event-libs==1.02.170
tar==1.26
xz==5.2.2
dhcp-libs==4.2.5
libogg==1.3.0
hostname==3.13
selinux-policy==3.13.1
GConf2==3.2.6
libedit==3.0
grub2-tools-extra==2.02
libasyncns==0.8
sysvinit-tools==2.88
systemd-sysv==219
wget==1.14
cups-libs==1.6.3
openssl-libs==1.0.2k
tomcat==7.0.76
python-ethtool==0.8
python-slip==0.4.0
linux-firmware==20200421
python-setuptools==0.9.8
yum-metadata-parser==1.1.4
bind-license==9.11.4
python-iniparse==0.4
firewalld==0.6.3
python-gofer==2.12.5
tomcat-webapps==7.0.76
lshw==B.02.18
python-html5lib==0.999
gnupg2==2.0.22
kexec-tools==2.0.15
open-vm-tools==11.0.5
dracut-config-rescue==033
ipset-libs==7.1
fipscheck==1.4.1
postgresql-libs==9.2.24
json-c==0.11
passwd==0.79
fuse-libs==2.9.2
libuser==0.60
xfsprogs==4.5.0
libseccomp==2.3.1
iwl105-firmware==18.168.6.1
mozjs17==17.0.0
iwl5150-firmware==8.24.2.2
iwl3160-firmware==25.30.13.0
iwl6050-firmware==41.28.5.1
libdrm==2.4.97
libaio==0.3.109
openssh==7.4p1
cronie==1.4.11
kernel==3.10.0
os-prober==1.58
katello-host-tools-fact-plugin==3.5.4
kernel==3.10.0
puppet6-release==6.0.0
saslwrapper==0.16
fxload==2002_04_11
python-chardet==2.2.1
libgcc==4.8.5
grub2-pc-modules==2.02
nss-softokn-freebl==3.53.1
nspr==4.25.0
libpipeline==1.2.3
libcap==2.22
coreutils==8.22

path: packages/packages.json
content: {
  "name": "my-nodejs-project",
  "version": "1.0.0",
  "description": "A sample Node.js project",
  "main": "index.js",
  "scripts": {
    "start": "node index.js",
    "dev": "nodemon index.js",
    "test": "echo \"No tests specified\" && exit 0"
  },
  "keywords": [],
  "author": "",
  "license": "MIT",
  "dependencies": {
    "express": "^4.19.2",
    "cors": "^2.8.5",
    "dotenv": "^16.4.5"
  },
  "devDependencies": {
    "nodemon": "^3.1.4"
  }
}


path: packages/packages.txt
content: django==6.2
requests==2.31.0
numpy==1.26.4
flask==3.0.1
pydantic==2.6.1
fastapi==0.109.0
urllib3==2.1.0
jinja2==3.1.3
markupsafe==2.1.5

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector:  ()