check-nvd

/check-nvd

Check if a package has existing CVEs in NVD, OSV.dev, and GitHub Security Advisories.

Process

Step 1: Query OSV.dev

# Query OSV.dev for known vulnerabilities
curl -s "https://api.osv.dev/v1/query" \
  -H "Content-Type: application/json" \
  -d "{\"package\":{\"name\":\"$ARGUMENTS\",\"ecosystem\":\"npm\"}}" \
  | python3 -m json.tool

If the package is not on npm, try other ecosystems:

# PyPI
curl -s "https://api.osv.dev/v1/query" -d "{\"package\":{\"name\":\"$ARGUMENTS\",\"ecosystem\":\"PyPI\"}}"

# Go
curl -s "https://api.osv.dev/v1/query" -d "{\"package\":{\"name\":\"$ARGUMENTS\",\"ecosystem\":\"Go\"}}"

# RubyGems
curl -s "https://api.osv.dev/v1/query" -d "{\"package\":{\"name\":\"$ARGUMENTS\",\"ecosystem\":\"RubyGems\"}}"

Step 2: Query GitHub Security Advisories

# Search GitHub Advisory Database
gh api graphql -f query='
{
  securityAdvisories(first: 20, orderBy: {field: PUBLISHED_AT, direction: DESC}, identifier: {type: CVE, value: ""}) {
    nodes {
      ghsaId
      summary
      severity
      publishedAt
      identifiers { type value }
    }
  }
}'

# Or search by package name
gh api "/advisories?ecosystem=npm&package=$ARGUMENTS" 2>/dev/null

Step 3: Check the Repo Directly

# Find the GitHub repo
npm view "$ARGUMENTS" repository.url 2>/dev/null

# Check repo security advisories
gh api "repos/<owner>/<repo>/security-advisories" 2>/dev/null

Step 4: Summarize Results

Present a summary:

CVE CHECK: <package-name>

Total CVEs found: <count>

Severity breakdown:
  CRITICAL: <count>
  HIGH:     <count>
  MEDIUM:   <count>
  LOW:      <count>

Recent CVEs (last 12 months):
  <CVE-ID> | <severity> | <summary> | <date>
  <CVE-ID> | <severity> | <summary> | <date>

Recent security fixes (from git log):
  <commit hash> | <date> | <message>

Assessment:
  <0-3 CVEs>: Under-audited. Good target.
  <4-10 CVEs>: Moderately audited. Proceed with caution -- look for incomplete fixes.
  <>10 CVEs>: Over-audited. Skip unless looking for fix bypasses.

Incomplete fix opportunities:
  <List any CVEs where the fix might be incomplete based on the patch>