lockhawk
lockhawk: A focused open-source scanner for npm, Yarn, and pnpm lockfiles. Ranked #54 of 65 in Software Composition Analysis Software by our editors (5.3/10); pricing: Free plan; best for free JavaScript dependency vulnerability checks.
At a glance
- Editor score5.3 / 10
- PricingFree plan
- Best forFree JavaScript dependency vulnerability checks
- Free planYes
- Paid fromFree
- SBOM generationNo
- Facts checked19 Sep 2026
Where it wins
- Scans direct and transitive npm, Yarn, and pnpm dependencies
- Produces SARIF, JSON, JUnit, Markdown, HTML, and table reports
- Adds offline caching, severity gates, and GitHub Actions support
Where it doesn't
- Supports npm, Yarn, and pnpm ecosystems only
- Does not generate software bills of materials
- Does not perform reachability analysis
Our verdict on lockhawk
lockhawk is an open-source software composition analysis tool for JavaScript projects using npm, Yarn, or pnpm. It reads package-lock.json, yarn.lock, and pnpm-lock.yaml files, builds a dependency tree that includes transitive packages, and checks dependencies against OSV.dev. Its intended audience is developers and security teams that want free vulnerability checks in local development or CI/CD workflows, with self-hosted deployment and a programmatic scanning API.
The tool’s strongest fit is a focused lockfile-scanning workflow. It offers table, JSON, SARIF, JUnit, Markdown, and standalone HTML reports, plus an interactive local dashboard for reviewing results. Configurable severity thresholds and build-failure gates help teams enforce vulnerability policies in automated pipelines. The bundled GitHub Action supports SARIF uploads, while integrations with Azure DevOps and GitLab CI extend its CI/CD reach. Offline vulnerability database caching is useful for environments that need local database access during scans.
lockhawk is free and open source, making it suitable for teams that want to run dependency checks without adopting a paid tier. Its scope is deliberately narrow: the published feature set centers on JavaScript lockfiles and vulnerability identification. Teams that need SBOM generation, reachability analysis, or broader software composition analysis coverage should choose a product with those capabilities. For developers and organizations focused on direct and transitive npm-family dependency checks, lockhawk offers a practical combination of local reporting, CI/CD gates, and automation interfaces.
Your product? Our editors can test lockhawk in depth and publish a review, labelled as paid · from $149/mo →
lockhawk pricing
lockhawk fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Supported ecosystems | npm, Yarn, pnpm |
| SBOM generation | No |
| Reachability analysis | No |
| Pull request scanning | Not verified |
| Monitored projects | Not verified |
| Deployment options | Self_hosted |
| Deployment | Self-hosted |
| Integrations | 4 integrations: OSV.dev, GitHub Actions, Azure DevOps, GitLab CI |
| Pricing | Free plan |
| Website | github.com |
| Facts checked | 19 Sep 2026 |
lockhawk integrations
lockhawk lists 4 integrations on its own site.
- OSV.dev
- GitHub Actions
- Azure DevOps
- GitLab CI
Alternatives to lockhawk
- Snyk Open SourceBroad SCA coverage with reachability, SBOMs, pull-request scanning, and monitoring.9.4
- FOSSAA mature SCA platform covering dependencies, SBOMs, containers, licenses, and policy controls.9.3
- Safeguard SCAA budget-conscious SCA platform with reachability analysis, SBOMs, and remediation workflows.9.1
See all lockhawk alternatives →
Used lockhawk? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used lockhawk for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
lockhawk is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/lockhawk/"><img src="https://www.itechguides.com/best/badge/lockhawk.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update