Vinum CLI

The installer downloads a single executable that embeds its own runtime, so you do not need Node.js or npm.

curl -fsSL https://vinum.dev/install.sh | bash

vinum --version

• Installs to ~/.local/bin/vinum. It does not use sudo or edit your shell profile; if the folder is not on your PATH, the installer tells you what to add.
• Verifies the release's SHA-256 checksum and runs the new executable before replacing any existing install.
• Supports Linux (glibc, x64 and arm64) and macOS (Intel and Apple silicon). Alpine/musl and Windows are not supported yet.
• Needs curl and sha256sum or shasum.

To read the script first, or to choose a version or folder:

curl -fsSL https://vinum.dev/install.sh -o install-vinum.sh
VINUM_INSTALL_DIR="$HOME/bin" sh install-vinum.sh 0.1.0

Run the installer again to update. There is no self-update command yet.

Pass a package name, optionally with an exact version. Without a version, Vinum resolves the current one and always prints which exact release it analyzed.

vinum analyze express
vinum analyze express@5.1.0
vinum analyze @scope/name@1.2.3

Versions must be exact, such as 5.1.0. Ranges and tags like ^5 or latest are rejected so a result always refers to one published release.

Run it with no package from inside a project. Vinum finds the owning lockfile in the current folder or a parent and analyzes every resolved direct and transitive dependency.

cd my-app
vinum analyze

• Reads npm package-lock.json (v2 and v3), pnpm-lock.yaml (v9), Yarn Classic v1 and modern Yarn lockfiles. If several lockfiles exist, set packageManager in package.json.
• The summary shows totals first, then only the packages with findings or that could not be analyzed.
• Local workspace links, patched, Git and private-registry dependencies are reported as skipped, because Vinum only analyzes public npm releases.
• Add --details for per-package evidence.

express@5.1.0

100 / 100  ████████████████████████  No major concerns

Coverage  ◐ Limited · 25 analysis gaps
Findings  None

Observed behavior
  • Reads environment configuration
  • Uses network or DNS access
  • Uses filesystem access

Report    https://vinum.dev/express/5.1.0

⚠ Some behavior involving dependencies and dynamic calls could not be fully traced.

• The score runs from 0 to 100 and its color matches the website: green for no major concerns, yellow for limited concerns, orange for notable concerns, red for high-risk evidence.
• Coverage says how much of the package Vinum could trace. Limited coverage means some code, such as calls into dependencies or dynamically built references, could not be followed.
• Findings lists observations worth a closer look with the file and line behind each one. Observed behavior lists what the package can do, which is normal for most packages.
• Open the report link for the full evidence.

A package with no findings is not guaranteed safe. See What is Vinum? for how scores and coverage work.

Progress shows in the terminal while it runs, and colors turn off when the output is piped or NO_COLOR is set. The --json schema is published at https://vinum.dev/schemas/cli/v1.json.

• Only public package names and versions, plus the integrity hash from your lockfile, are sent to Vinum.
• Your source files, lockfile, project name, paths and dependency graph are not uploaded.
• The CLI does not install dependencies, run scripts or execute package code, and it adds no telemetry or visitor ID.
• Results for public packages are shared: if someone already analyzed a release, you get that result immediately.