CLI tool for scanning NuGet package dependancies for known vulnerabilities.
Pack Scan makes use of the Sonatype OSS Index API (https://ossindex.net) to check your projects NuGet package dependancies which are known to have security vulnerabilities.
dotnet tool install -g packscan
NuGet package is available here:
https://www.nuget.org/packages/PackScan
packscan [-af] [file|nuget]
List all nuget package dependancies, and their vulnerability status, including information about the vulnerabilities.
The following options are available.
| -f, --file | either a .csproj or packages.config file containing nuget references. |
| -v, --verbose | display verbose output, including vulnerability description and references. |
Exit status:
| 0 | if OK, |
| 1 | if packages contain a vulnerability |
Examples of use:
List all vulnerability statuses for packages in specified file.
packscan -f packages.config
List vulnerability status for specified package/version.
packscan LibGit2Sharp@0.2.0 -v
Written by Jamil Geor
Copyright © 2018 Jamil Geor. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.