![\"Sandworm](\"logo-dark.png\")
\n\n\n\nBeautiful Security & License Compliance Reports For Your App's Dependencies 🪱\n\n## Summary\n\n- Free & open source command-line tool\n- Works with [npm](http://npmjs.com/), [Yarn](https://yarnpkg.com/), [pnpm](https://pnpm.io/), and [Composer](https://getcomposer.org/)\n- Scans your project & dependencies for vulnerabilities, license, and metadata issues\n- Supports npm/Yarn/pnpm workspaces\n- Supports [marking issues as resolved](https://docs.sandworm.dev/audit/resolving-issues)\n- Supports [custom license policies](https://docs.sandworm.dev/audit/license-policies)\n- [Configurable fail conditions](https://docs.sandworm.dev/audit/fail-policies) for CI / GIT hook workflows\n- Can connect to [private/custom npm registries](https://docs.sandworm.dev/audit/custom-registries)\n- Outputs:\n - JSON issue & license usage reports\n - Easy to grok SVG dependency tree & treemap visualizations\n - Powered by D3\n - Overlays security vulnerabilities\n - Overlays package license info\n - CSV of all dependencies & license info\n\n### Generate a report\n\n\n\n### Navigate charts\n\n\n\n### CSV output\n\n\n\n### JSON output\n\n```json\n{\n \"createdAt\": \"...\",\n \"packageManager\": \"...\",\n \"name\": \"...\",\n \"version\": \"...\",\n \"rootVulnerabilities\": [...],\n \"dependencyVulnerabilities\": [...],\n \"licenseUsage\": {...},\n \"licenseIssues\": [...],\n \"metaIssues\": [...],\n \"errors\": [...],\n}\n```\n\n\n\n### Get Involved\n\n- Have a support question? [Post it here](https://github.com/sandworm-hq/sandworm-audit/discussions/categories/q-a).\n- Have a feature request? [Post it here](https://github.com/sandworm-hq/sandworm-audit/discussions/categories/ideas).\n- Did you find a security issue? [See SECURITY.md](SECURITY.md).\n- Did you find a bug? [Post an issue](https://github.com/sandworm-hq/sandworm-audit/issues/new/choose).\n- Want to write some code? See [CONTRIBUTING.md](CONTRIBUTING.md).\n\n## Get Started\n\n> **Note**\n> Sandworm Audit requires Node 14.19+.\n\nInstall `sandworm-audit` globally via your favorite package manager:\n\n```bash\nnpm install -g @sandworm/audit\n# or yarn global add @sandworm/audit\n# or pnpm add -g @sandworm/audit\n```\n\nThen, run `sandworm-audit` in the root directory of your application. Make sure there's a manifest and a lockfile.\n\nYou can also directly run without installing via:\n\n```bash\nnpx @sandworm/audit@latest\n# or yarn dlx -p @sandworm/audit sandworm\n# or pnpm --package=@sandworm/audit dlx sandworm\n```\n\nAvailable options:\n\n```\nOptions:\n -v, --version Show version number [boolean]\n --help Show help [boolean]\n -o, --output-path The path of the output directory, relative to the\n application path [string] [default: \"sandworm\"]\n -d, --include-dev Include dev dependencies[boolean] [default: false]\n --sv, --show-versions Show package versions in chart names\n [boolean] [default: false]\n -p, --path The path to the application to audit [string]\n --md, --max-depth Max depth to represent in charts [number]\n --ms, --min-severity Min issue severity to represent in charts [string]\n --lp, --license-policy Custom license policy JSON string [string]\n -f, --from Load data from \"registry\" or \"disk\"\n [string] [default: \"registry\"]\n --fo, --fail-on Fail policy JSON string [string] [default: \"[]\"]\n -s, --summary Print a summary of the audit results to the\n console [boolean] [default: true]\n --root-vulnerabilites Include vulnerabilities for the root project\n [boolean] [default: false]\n --skip-license-issues Skip scanning for license issues\n [boolean] [default: false]\n --skip-meta-issues Skip scanning for meta issues\n [boolean] [default: false]\n --skip-tree Don't output the dependency tree chart\n [boolean] [default: false]\n --force-tree Force build large dependency tree charts\n [boolean] [default: false]\n --skip-treemap Don't output the dependency treemap chart\n [boolean] [default: false]\n --skip-csv Don't output the dependency csv file\n [boolean] [default: false]\n --skip-report Don't output the report json file\n [boolean] [default: false]\n --skip-all Don't output any file [boolean] [default: false]\n --show-tips Show usage tips [boolean] [default: true]\n```\n\n### Documentation\n\n> [Read the full docs here](https://docs.sandworm.dev/audit).\n\n## Samples on Sandworm.dev\n\n- [Apollo Client](https://sandworm.dev/npm/package/apollo-client)\n- [AWS SDK](https://sandworm.dev/npm/package/aws-sdk)\n- [Express](https://sandworm.dev/npm/package/express)\n- [Mocha](https://sandworm.dev/npm/package/mocha)\n- [Mongoose](https://sandworm.dev/npm/package/mongoose)\n- [Nest.js](https://sandworm.dev/npm/package/@nestjs/cli)\n- [Redis](https://sandworm.dev/npm/package/redis)\n","readmeFilename":"README.md"}