# Package Managers and Lockfile Formats Supported by OSV-Scanner

> Discover the 15+ package managers like npm, Maven, PyPI, and Go modules supported by OSV-Scanner. Learn which lockfile formats it parses for comprehensive vulnerability scanning.

- Repository: [Google/osv-scanner](https://github.com/google/osv-scanner)
- Tags: supported-features
- Published: 2026-04-25

---

**OSV-Scanner supports 15+ package managers—including npm, Maven, PyPI, Go modules, Rust Cargo, and NuGet—by parsing specific lockfile names defined in [`pkg/osvscanner/internal/scanners/lockfile.go`](https://github.com/google/osv-scanner/blob/main/pkg/osvscanner/internal/scanners/lockfile.go) and registered via the Scalibr extractor framework in [`internal/scalibrplugin/presets.go`](https://github.com/google/osv-scanner/blob/main/internal/scalibrplugin/presets.go).**

The `google/osv-scanner` CLI detects vulnerable dependencies by analyzing lockfiles and OS package listings. Its parsing capabilities are defined by a central filename-to-extractor mapping in the source code and a plugin preset system that registers Scalibr extractors for each supported ecosystem.

## Supported Package Managers and Lockfile Formats

OSV-Scanner recognizes lockfiles from major programming languages and operating systems. The scanner matches filenames against a hardcoded map in [`pkg/osvscanner/internal/scanners/lockfile.go`](https://github.com/google/osv-scanner/blob/main/pkg/osvscanner/internal/scanners/lockfile.go) (lines 45-78) that associates each file with a specific Scalibr extractor.

### JavaScript and Node.js

- **[`package-lock.json`](https://github.com/google/osv-scanner/blob/main/package-lock.json)** – npm lockfile resolved to `packagelockjson` extractor
- **`yarn.lock`** – Yarn lockfile
- **[`pnpm-lock.yaml`](https://github.com/google/osv-scanner/blob/main/pnpm-lock.yaml)** – pnpm lockfile
- **`bun.lock`** – Bun lockfile

### Python

- **`Pipfile.lock`** – Pipenv lockfile
- **`poetry.lock`** – Poetry lockfile
- **`pdm.lock`** – PDM lockfile
- **`uv.lock`** – uv lockfile
- **[`pylock.toml`](https://github.com/google/osv-scanner/blob/main/pylock.toml)** – PEP 751 standard lockfile
- **[`requirements.txt`](https://github.com/google/osv-scanner/blob/main/requirements.txt)** – pip requirements file

### Java

- **[`pom.xml`](https://github.com/google/osv-scanner/blob/main/pom.xml)** – Maven project object model
- **`gradle.lockfile`** – Gradle dependency lock
- **`buildscript-gradle.lockfile`** – Gradle buildscript dependencies
- **[`verification-metadata.xml`](https://github.com/google/osv-scanner/blob/main/verification-metadata.xml)** – Gradle verification metadata

### Go

- **`go.mod`** – Go modules file

### Rust

- **`Cargo.lock`** – Cargo package manager lockfile

### PHP

- **`composer.lock`** – Composer dependency lock

### Ruby

- **`Gemfile.lock`** – Bundler lockfile
- **`gems.locked`** – Alternative Bundler lockfile

### .NET

- **[`packages.lock.json`](https://github.com/google/osv-scanner/blob/main/packages.lock.json)** – Central package management lockfile
- **`packages.config`** – Legacy NuGet packages
- **[`deps.json`](https://github.com/google/osv-scanner/blob/main/deps.json)** – Dependency manifest

### Dart and Flutter

- **`pubspec.lock`** – Dart package manager lockfile

### Additional Ecosystems

- **Erlang**: `mix.lock` (Mix build tool)
- **R**: `renv.lock` (renv package manager)
- **Haskell**: `cabal.project.freeze`, `stack.yaml.lock`
- **C/C++**: `conan.lock` (Conan package manager)
- **OSV-Scanner native**: [`osv-scanner.json`](https://github.com/google/osv-scanner/blob/main/osv-scanner.json) (special parser for the tool's own JSON output format)

### Linux OS Packages

- **`apk-installed`** – Alpine Linux package database
- **`dpkg-status`** – Debian/Ubuntu package status file

## How OSV-Scanner Identifies Lockfile Types

When scanning a project, OSV-Scanner uses two core mechanisms in the source code to determine which parser to invoke.

### Filename-to-Extractor Mapping

In **[`pkg/osvscanner/internal/scanners/lockfile.go`](https://github.com/google/osv-scanner/blob/main/pkg/osvscanner/internal/scanners/lockfile.go)**, the scanner maintains a map linking filenames to Scalibr extractor names. When the CLI encounters [`package-lock.json`](https://github.com/google/osv-scanner/blob/main/package-lock.json), it resolves to `packagelockjson.Name` according to the mapping defined at lines 45-78.

### Plugin Registration

The **[`internal/scalibrplugin/presets.go`](https://github.com/google/osv-scanner/blob/main/internal/scalibrplugin/presets.go)** file registers these extractors under the `"lockfile"` preset (lines 73-110). This preset aggregates all supported extractors into a single group that the CLI can activate.

### Path Parsing Logic

The **`ParseLockfilePath`** function (lines 80-124 in [`lockfile.go`](https://github.com/google/osv-scanner/blob/main/lockfile.go)) implements the extraction workflow:

1. Splits any `parseAs:` prefix from the file path using string parsing
2. Invokes `ParseAsToPlugin` to locate the matching extractor by filename or explicit override
3. Returns "could not determine extractor" if the filename is absent from the mapping

## Scanning Lockfiles: Practical Examples

### Scan a Single npm Lockfile

```bash
osv-scanner scan path/to/package-lock.json

```

The CLI resolves [`package-lock.json`](https://github.com/google/osv-scanner/blob/main/package-lock.json) to the npm extractor and queries the OSV database for vulnerabilities in all listed packages.

### Scan Multiple Ecosystems Simultaneously

```bash
osv-scanner scan \
  frontend/package-lock.json \
  backend/go.mod \
  python/requirements.txt

```

OSV-Scanner iterates over each path, invokes the appropriate extractor (npm, Go modules, Python requirements), and aggregates results into a unified report.

### Enable the Lockfile Preset Explicitly

```bash
osv-scanner scan --preset lockfile ./my-project/

```

This command loads `ExtractorPresets["lockfile"]` from **presets.go**, activating all lockfile extractors to discover any recognized files under `./my-project/`.

### Force a Specific Parser

```bash
osv-scanner scan "npm:./my-dir/package-lock.json"

```

The `parseAs` prefix (`npm:`) bypasses filename lookup and directly selects the npm extractor, supporting non-standard filenames or custom lockfile names.

## Key Source Files and Implementation

Understanding these files helps when debugging scan failures or contributing new extractors:

- **[`pkg/osvscanner/internal/scanners/lockfile.go`](https://github.com/google/osv-scanner/blob/main/pkg/osvscanner/internal/scanners/lockfile.go)**: Contains the `ParseLockfilePath` and `ParseAsToPlugin` functions and the central filename-to-extractor mapping (lines 45-78).

- **[`internal/scalibrplugin/presets.go`](https://github.com/google/osv-scanner/blob/main/internal/scalibrplugin/presets.go)**: Defines `ExtractorPresets["lockfile"]` which registers all Scalibr extractors for the scanner (lines 73-110).

- **[`pkg/osvscanner/scan.go`](https://github.com/google/osv-scanner/blob/main/pkg/osvscanner/scan.go)**: Orchestrates the scanning workflow and invokes lockfile parsing logic for each CLI argument.

## Summary

- OSV-Scanner supports **15+ package managers** across JavaScript, Python, Java, Go, Rust, PHP, Ruby, .NET, Dart, Erlang, R, Haskell, C/C++, and major Linux distributions including Alpine and Debian/Ubuntu.
- Lockfile detection relies on a **hardcoded filename map** in [`pkg/osvscanner/internal/scanners/lockfile.go`](https://github.com/google/osv-scanner/blob/main/pkg/osvscanner/internal/scanners/lockfile.go) that associates files like `Cargo.lock` and `poetry.lock` with specific Scalibr extractors.
- The **Scalibr plugin system** in [`internal/scalibrplugin/presets.go`](https://github.com/google/osv-scanner/blob/main/internal/scalibrplugin/presets.go) registers these extractors under the `"lockfile"` preset.
- Use **`parseAs:` prefixes** to force specific parsers when filenames don't match standard patterns.
- The scanner also supports **OS-level vulnerability detection** via `apk-installed` and `dpkg-status` files.

## Frequently Asked Questions

### Can OSV-Scanner detect operating system package vulnerabilities?

Yes. According to the source code in [`pkg/osvscanner/internal/scanners/lockfile.go`](https://github.com/google/osv-scanner/blob/main/pkg/osvscanner/internal/scanners/lockfile.go), OSV-Scanner supports Alpine Linux (`apk-installed`) and Debian/Ubuntu (`dpkg-status`) package databases to detect vulnerabilities in system-level dependencies.

### How do I scan a lockfile if OSV-Scanner cannot determine the extractor?

If your lockfile uses a non-standard name absent from the filename map, prepend the path with the `parseAs:` prefix followed by the ecosystem identifier. For example, `osv-scanner scan "npm:./custom-name.lock"` forces the npm extractor regardless of the actual filename, bypassing the normal `ParseAsToPlugin` resolution logic.

### Does OSV-Scanner support Python Poetry and UV lockfiles?

Yes. The [`lockfile.go`](https://github.com/google/osv-scanner/blob/main/lockfile.go) source maps both `poetry.lock` and `uv.lock` to their respective Scalibr extractors, alongside other Python formats including `Pipfile.lock`, `pdm.lock`, [`pylock.toml`](https://github.com/google/osv-scanner/blob/main/pylock.toml), and [`requirements.txt`](https://github.com/google/osv-scanner/blob/main/requirements.txt).

### What is the [`osv-scanner.json`](https://github.com/google/osv-scanner/blob/main/osv-scanner.json) format listed among supported lockfiles?

This is OSV-Scanner's native JSON output format. By specifying [`osv-scanner.json`](https://github.com/google/osv-scanner/blob/main/osv-scanner.json) as an input, you can re-scan previous results or integrate with external tools that generate OSV-Scanner compatible manifests. This format is handled by a dedicated special parser in the scanner implementation, distinct from the standard package manager extractors.