grype-trivy-offline-vulnerability-scanning

name	grype-trivy-offline-vulnerability-scanning
description	How to use offline vulnerability scanning tools like grype, trivy, or osv-scanner to detect vulnerabilities in dependency lock files without network access.

Grype (Anchore)

Grype scans container images and filesystem paths for vulnerabilities using a local database.

# Scan a lockfile directory
grype dir:/root/ --only-fixed --output json

# Scan specifically for npm
grype sbom:package-lock.json

# Filter by severity
grype dir:/root/ --fail-on high

Grype JSON Output

{
  "matches": [
    {
      "vulnerability": {
        "id": "CVE-2021-XXXXX",
        "severity": "High",
        "cvss": [{"metrics": {"baseScore": 7.5}}],
        "fix": {"versions": ["1.2.3"], "state": "fixed"},
        "urls": ["https://nvd.nist.gov/vuln/detail/CVE-2021-XXXXX"]
      },
      "artifact": {
        "name": "package-name",
        "version": "1.0.0"
      }
    }
  ]
}

Trivy

# Scan filesystem
trivy fs /root/ --severity HIGH,CRITICAL --format json

# Scan specific lockfile
trivy fs --scanners vuln --severity HIGH,CRITICAL /root/package-lock.json

Trivy JSON Output

{
  "Results": [
    {
      "Target": "package-lock.json",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-XXXXX",
          "PkgName": "package-name",
          "InstalledVersion": "1.0.0",
          "FixedVersion": "1.2.3",
          "Severity": "HIGH",
          "Title": "Description",
          "CVSS": {"nvd": {"V3Score": 7.5}},
          "PrimaryURL": "https://..."
        }
      ]
    }
  ]

osv-scanner

osv-scanner --lockfile=/root/package-lock.json --format json

Updating Offline Databases

# Grype
grype db update
grype db status

# Trivy
trivy --download-db-only
# DB location: ~/.cache/trivy/db/