Sandworm Audit review
A focused free CLI for vulnerability, license, and metadata checks in supported projects.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Sandworm Audit is a free, open-source command-line tool for auditing application dependencies. It is designed for teams working with npm, Yarn, pnpm, or Composer that need vulnerability, license, and dependency-metadata checks in local workflows, CI pipelines, or Git hooks. It uses npm, Yarn, and pnpm audit results for CVE scanning, supports the GitHub Advisory Database, and includes workspace and private or custom package registry support. JavaScript and PHP projects with a preference for self-hosted tooling are the clearest fit.
Its strongest area is policy-oriented checking and reporting. Teams can validate dependency licenses against custom policies, configure failure conditions for CI and Git hooks, and track resolved issues. JSON issue and license-usage reports support automated processing, while CSV export provides dependency and license data for broader review. SVG dependency-tree and treemap visualizations add a visual way to inspect project structure. These features make the tool useful when a team wants checks that can block workflows as well as artifacts for analysis.
The trade-off is a focused ecosystem and analysis scope. The published coverage centers on npm, Yarn, pnpm, and Composer, rather than a broader set of package managers. Sandworm Audit also does not provide SBOM generation or reachability analysis, so teams that require those capabilities should consider a product with a wider software-composition analysis feature set. Choose it for free, open-source dependency auditing with configurable CI and Git-hook checks; choose an alternative when broader ecosystem coverage or SBOM and reachability capabilities are core requirements.
Sandworm Audit pros and cons
- Where it wins
- Free, open-source auditing for vulnerabilities, licenses, and metadata
- CI and Git-hook failure conditions support policy enforcement
- JSON, CSV, and SVG outputs support reporting and dependency review
- Where it doesn't
- Coverage is limited to npm, Yarn, pnpm, and Composer
- No documented SBOM generation or reachability analysis
- Self-hosted deployment puts setup and maintenance on the project team
Sandworm Audit fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update