Sandworm Audit
Sandworm Audit: A focused free CLI for vulnerability, license, and metadata checks in supported projects. Ranked #59 of 65 in Software Composition Analysis Software by our editors (5.3/10); pricing: Free plan; best for javaScript and Composer projects needing CI checks.
At a glance
- Editor score5.3 / 10
- PricingFree plan
- Best forJavaScript and Composer projects needing CI checks
- Free planYes
- Paid fromFree
- SBOM generationNo
- Facts checked19 Sep 2026
Where it wins
- Free, open-source auditing for vulnerabilities, licenses, and metadata
- CI and Git-hook failure conditions support policy enforcement
- JSON, CSV, and SVG outputs support reporting and dependency review
Where it doesn't
- Coverage is limited to npm, Yarn, pnpm, and Composer
- No documented SBOM generation or reachability analysis
- Self-hosted deployment puts setup and maintenance on the project team
Our verdict on Sandworm Audit
Sandworm Audit is a free, open-source command-line tool for auditing application dependencies. It is designed for teams working with npm, Yarn, pnpm, or Composer that need vulnerability, license, and dependency-metadata checks in local workflows, CI pipelines, or Git hooks. It uses npm, Yarn, and pnpm audit results for CVE scanning, supports the GitHub Advisory Database, and includes workspace and private or custom package registry support. JavaScript and PHP projects with a preference for self-hosted tooling are the clearest fit.
Its strongest area is policy-oriented checking and reporting. Teams can validate dependency licenses against custom policies, configure failure conditions for CI and Git hooks, and track resolved issues. JSON issue and license-usage reports support automated processing, while CSV export provides dependency and license data for broader review. SVG dependency-tree and treemap visualizations add a visual way to inspect project structure. These features make the tool useful when a team wants checks that can block workflows as well as artifacts for analysis.
The trade-off is a focused ecosystem and analysis scope. The published coverage centers on npm, Yarn, pnpm, and Composer, rather than a broader set of package managers. Sandworm Audit also does not provide SBOM generation or reachability analysis, so teams that require those capabilities should consider a product with a wider software-composition analysis feature set. Choose it for free, open-source dependency auditing with configurable CI and Git-hook checks; choose an alternative when broader ecosystem coverage or SBOM and reachability capabilities are core requirements.
Your product? Our editors can test Sandworm Audit in depth and publish a review, labelled as paid · from $149/mo →
Sandworm Audit pricing
Sandworm Audit fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Supported ecosystems | npm, Yarn, pnpm, Composer |
| SBOM generation | No |
| Reachability analysis | Not verified |
| Pull request scanning | Not verified |
| Monitored projects | Not verified |
| Deployment options | Self_hosted |
| Deployment | Self-hosted |
| Integrations | 5 integrations: npm, Yarn, pnpm, Composer, GitHub Advisory Database |
| Pricing | Free plan |
| Website | sandworm.dev |
| Facts checked | 19 Sep 2026 |
Sandworm Audit integrations
Sandworm Audit lists 5 integrations on its own site.
- npm
- Yarn
- pnpm
- Composer
- GitHub Advisory Database
Alternatives to Sandworm Audit
- Snyk Open SourceBroad SCA coverage with reachability, SBOMs, pull-request scanning, and monitoring.9.4
- FOSSAA mature SCA platform covering dependencies, SBOMs, containers, licenses, and policy controls.9.3
- Safeguard SCAA budget-conscious SCA platform with reachability analysis, SBOMs, and remediation workflows.9.1
See all Sandworm Audit alternatives →
Used Sandworm Audit? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Sandworm Audit for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Sandworm Audit is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/sandworm-audit/"><img src="https://www.itechguides.com/best/badge/sandworm-audit.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update