Sandworm Audit is a free, open-source CLI tool that scans application dependencies for security vulnerabilities, license compliance, and metadata issues, providing detailed visual and data reports.
Security & License Compliance For Your App's Dependencies 🪱
This tool is designed for developers and security teams who need to ensure their application's dependencies are secure and compliant with licensing policies. It is used during development and CI workflows to identify and manage vulnerabilities, license risks, and metadata problems across multiple package managers and workspaces.
Sandworm Audit requires Node.js version 14.19 or higher. It is recommended to run the tool in the root directory of your project where the manifest and lockfile are present. Custom license policies and fail conditions can be configured to integrate with CI/CD pipelines and Git hooks for automated enforcement. The tool supports private npm registries, making it suitable for enterprise environments.
Ensure Node.js version 14.19 or higher is installed
Install globally via npm: npm install -g @sandworm/audit
Alternatively, install globally via yarn: yarn global add @sandworm/audit
Or install globally via pnpm: pnpm add -g @sandworm/audit
Run the tool in your project root directory where manifest and lockfile exist
Optionally, run without installation using npx: npx @sandworm/audit@latest
Or with yarn dlx: yarn dlx -p @sandworm/audit sandworm
Or with pnpm dlx: pnpm --package=@sandworm/audit dlx sandwormsandworm-audit
Runs the audit scan in the current directory and generates reports
npx @sandworm/audit@latest
Runs Sandworm Audit without prior installation
npm install -g @sandworm/audit
Installs Sandworm Audit globally using npm
sandworm-audit -o <output-path>
Specifies the output directory for generated reports
sandworm-audit -d
Includes dev dependencies in the audit scan
sandworm-audit --sv
Shows package versions in chart names within visual reports
sandworm-audit -p <path>
Specifies a custom path to the application to audit
sandworm-audit --md <max-depth>
Sets the maximum depth to represent in charts
sandworm-audit --ms <min-severity>
Filters issues by minimum severity to display in charts
sandworm-audit --lp <license-policy>
Applies a custom license policy JSON string for compliance checks