cve-lite-on-pi

A short write-up of running CVE Lite CLI against the pi monorepo, and what it found.

Background

This experiment was prompted by the article "OWASP CVE Lite CLI – New Tool to Scan for Vulnerabilities in Your Projects" (CyberSecurityNews).

What is CVE Lite CLI?

CVE Lite CLI is a developer-friendly, local command-line scanner for JavaScript/TypeScript projects. Instead of installing or running your dependencies, it reads your lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock, or bun.lockb), collects every resolved package version, and checks those versions against the OSV (Open Source Vulnerabilities) database. It then prints prioritized findings and copy-and-run fix commands, and exits non-zero when urgent issues exist — making it easy to drop into CI. It supports npm, pnpm, Yarn, and Bun.

What we did

We ran CVE Lite CLI against the pi monorepo and recorded the full journey — setup, the scan pipeline, the discovery, and suggested remediation — in pi-main-cve-lite-journey.md.

Advisory source: OSV (https://api.osv.dev) · Packages parsed: 443 from package-lock.json

Key finding

1 CRITICAL vulnerability — [email protected]

Suggested fix (not applied — this is a report-only study):

npm install -w packages/agent -w packages/ai -w packages/coding-agent [email protected]

See the full report for the scan pipeline internals, validation details, risk-based mitigations, and scope/limitations: pi-main-cve-lite-journey.md.

Contents

• README.md — this overview
• pi-main-cve-lite-journey.md — the detailed scan journey and findings report

This repository documents a one-off security scan for educational purposes. No remediation was applied to the upstream pi project.