lockhawk review
A focused open-source scanner for npm, Yarn, and pnpm lockfiles.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
lockhawk is an open-source software composition analysis tool for JavaScript projects using npm, Yarn, or pnpm. It reads package-lock.json, yarn.lock, and pnpm-lock.yaml files, builds a dependency tree that includes transitive packages, and checks dependencies against OSV.dev. Its intended audience is developers and security teams that want free vulnerability checks in local development or CI/CD workflows, with self-hosted deployment and a programmatic scanning API.
The tool’s strongest fit is a focused lockfile-scanning workflow. It offers table, JSON, SARIF, JUnit, Markdown, and standalone HTML reports, plus an interactive local dashboard for reviewing results. Configurable severity thresholds and build-failure gates help teams enforce vulnerability policies in automated pipelines. The bundled GitHub Action supports SARIF uploads, while integrations with Azure DevOps and GitLab CI extend its CI/CD reach. Offline vulnerability database caching is useful for environments that need local database access during scans.
lockhawk is free and open source, making it suitable for teams that want to run dependency checks without adopting a paid tier. Its scope is deliberately narrow: the published feature set centers on JavaScript lockfiles and vulnerability identification. Teams that need SBOM generation, reachability analysis, or broader software composition analysis coverage should choose a product with those capabilities. For developers and organizations focused on direct and transitive npm-family dependency checks, lockhawk offers a practical combination of local reporting, CI/CD gates, and automation interfaces.
lockhawk pros and cons
- Where it wins
- Scans direct and transitive npm, Yarn, and pnpm dependencies
- Produces SARIF, JSON, JUnit, Markdown, HTML, and table reports
- Adds offline caching, severity gates, and GitHub Actions support
- Where it doesn't
- Supports npm, Yarn, and pnpm ecosystems only
- Does not generate software bills of materials
- Does not perform reachability analysis
lockhawk fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update