OSV-SCALIBR is an extensible library for software composition analysis. It provides a file system scanner to extract software inventory data (e.g., installed language packages), detect known vulnerabilities, and generate SBOMs. It also includes container analysis functionality, guided remediation for transitive vulnerabilities, and the ability to run custom plugins. It can be used as a library or via the OSV-Scanner CLI, offering flexibility for various scanning needs, including container images and remote hosts.
