https://github.com/pritchyspritch/loldeps
LOLDeps stands for Living Off the Land Dependencies, it is a simple lightweight python tool that uses native package managers to highlight vulnerabilities in your package manifests and alerts you when it finds issues.
https://github.com/pritchyspritch/loldeps
dependencies dotnet gem npm python security
Last synced: 6 months ago
JSON representation
LOLDeps stands for Living Off the Land Dependencies, it is a simple lightweight python tool that uses native package managers to highlight vulnerabilities in your package manifests and alerts you when it finds issues.
- Host: GitHub
- URL: https://github.com/pritchyspritch/loldeps
- Owner: pritchyspritch
- License: mit
- Created: 2024-12-13T16:28:22.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2024-12-24T11:25:53.000Z (over 1 year ago)
- Last Synced: 2025-01-28T00:25:24.071Z (over 1 year ago)
- Topics: dependencies, dotnet, gem, npm, python, security
- Language: Python
- Homepage:
- Size: 27.3 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# LOLDeps
LOLDeps stands for Living Off the Land Dependencies, it is a simple lightweight python tool that uses native package managers to highlight vulnerabilities in your package manifests and alerts you when it finds issues.
This tool was built to allow outdated packages to be discovered using the package manager vulnerability reporting modern languages often ship with. The need came from a project where .NET and nuget were in use and there was a need/want to raise errors in pipelines for vulnerability issues in packages without the need to install and maintain complex tooling when the package manager itself already does the job perfectly well. This tool simply makes it easier to run those checks, display issues, and break builds when issues are found.
## Install
`pip install LOLDeps`
## Usage
```shell
usage: lold [-h] [--path PATH] [--failure-level FAILURE_LEVEL] [--ado]
options:
-h, --help show this help message and exit
--path PATH Path to the directory where your code and package manifest is held.
--failure-level FAILURE_LEVEL
Provide the risk level that must be failed on. Options: critical, high, moderate
--ado Choose if you are running in Azure DevOps pipeline.
```
## Currently supported
- dotnet list package --vulnerable (.net)
- Azure DevOps pipelines error messaging
## Roadmap
- npm audit (js)
- gem audit (ruby)
- GitHub Actions pipeline error messaging
- slack webhook integration options