Pharon and OSV-Scanner
Updated November 2, 2026
Pharon and OSV-Scanner in short
OSV-Scanner is Google's open-source scanner for the OSV.dev database: it matches lockfiles, manifests and container images against known vulnerabilities, on your machine or in CI, and can run fully offline. Pharon also uses OSV.dev data, so the advisories overlap. The difference is what happens after the scan: Pharon keeps watching, adds end-of-life dates and vendor breaches, alerts your team, and checks whether a machine installed a bad release.
Side by side
| OSV-Scanner | Pharon | |
|---|---|---|
| What it scans | Lockfiles and manifests for 13 languages, and the OS packages and build artifacts inside container images, run locally or in CI | Lockfiles, manifests, Dockerfiles, compose and workflow files, runtime version files and your cloud CLI, read on your machine or in your CI |
| Malicious packages | Not documented in OSV-Scanner's docs; the OSV.dev database it queries includes OpenSSF's malicious-packages reports | Yes, from OSV.dev and OpenSSF's malicious-packages reports, for npm, PyPI, Go, crates.io, RubyGems, Packagist, Maven, NuGet and GitHub Actions |
| Vulnerabilities | Yes, from the OSV.dev database; call analysis checks whether a vulnerable function is actually used | High and critical advisories from the last 30 days, and any vulnerability on CISA's exploited list |
| End-of-life runtimes and services | Not documented; an experimental flag reports packages deprecated by their author or removed from the registry | Yes, for runtimes, databases, Kubernetes, EKS and RDS, from endoflife.date |
| Vendor and SaaS breaches | Not documented | Yes, from security news and vendor bulletins |
| Was this machine affected? | Not documented: it reports what a scanned directory or image contains | Yes: a read-only local check reports, per location, whether the bad version is or was installed |
| Secrets to rotate | Not documented | Yes, by name, never their values |
| Fix pull requests | Not documented; an experimental fix command edits npm and Maven manifests and lockfiles locally | No |
| Where alerts go | Terminal output or table, Markdown, HTML, JSON, SARIF, SPDX and CycloneDX files; the GitHub Action can upload results to GitHub code scanning and run checks on pull requests | Email, Slack, webhooks, Claude Code sessions, a GitHub pull request check and a dashboard |
| Access to your code | Runs on your own machine or CI runner and queries the OSV.dev API; offline mode sends no project or dependency information | None: only names and versions are uploaded |
Facts about OSV-Scanner come from its documentation, checked on November 2, 2026. "Not documented" means we couldn't find the feature in its docs.
What OSV-Scanner does that Pharon doesn't
- Free and open source (Apache-2.0), and can scan fully offline
- Scans the OS packages in container images, layer by layer
- Checks dependency licenses against an allowlist
Using both
Run OSV-Scanner in CI to catch known vulnerabilities before you merge. Add Pharon to keep watching what you already run between scans, including images, CI actions, runtimes and vendors, and to check which machines installed a bad release and what to rotate.
Sources
Also compared: Dependabot, Snyk, Socket and Aikido. Read the docs to try Pharon.