This article documents the steps to use OWASP dependency check tool.

  1. Install the tool via homebrew

    brew update && brew install dependency-check

  2. Obtain an NVD (National Vulnerability Database) API Key

    https://nvd.nist.gov/developers/request-an-api-key

  3. Go to the directory you wish to scan (Usually the directory that contains your project files)

  4. Run the tool

    dependency-check --out . --scan . --nvdApiKey XXXX

  5. Once completed, the report will be available, in html format (dependency-check-report.html).

  6. The supported analyzers include jars, apks, nugets, Gemfile, package.lock, etc. View full list here.