Alternatives to NuGet Audit
NuGet Audit is the free, built-in vulnerability check in the .NET SDK (dotnet list package --vulnerable, since 5.0.200). It pulls advisories from GitHub's Advisory Database and reports Low, Moderate, High and Critical severity tiers, with no exploitation signal. GeekWala scans the same NuGet ecosystem (plus 7 others) via OSV, adding EPSS exploit probability and CISA KEV status.
Just want to scan? Try the NuGet Vulnerability Scanner.
Feature Comparison
| Feature | NuGet Audit (dotnet list package --vulnerable) | GeekWala |
|---|---|---|
| Vulnerability data | GitHub Advisory Database (default source) | OSV + EPSS + CISA KEV |
| Prioritization Key difference | Severity tier (Low/Moderate/High/Critical) + CVSS via linked GHSA | EPSS exploit probability + CISA KEV status |
| CISA KEV flagging Key difference | Yes — labeled field on every finding | |
| Interface | CLI only (dotnet list package --vulnerable) | Web dashboard + REST API |
| Ecosystems | NuGet (.NET) only | 8 ecosystems: npm, PyPI, Maven, Go, Rust, RubyGems, NuGet, Packagist |
| Transitive dependency coverage | Requires --include-transitive flag; defaults vary by target framework (direct-only pre-.NET 10, all from .NET 10) | Direct packages from a .csproj; the full tree only from packages.lock.json |
| Requires | .NET SDK 5.0.200 or later | No local SDK — manifest upload or CI integration |
| Scheduled / recurring scans | Not built in — schedule via CI | Yes (Pro) |
| Privacy | Local CLI, no upload | Package names only, no source code |
| Price | Free — built into the .NET SDK (5.0.200 and later), no separate install or license | Free tier + $12/mo or $99/yr Pro (flat-rate, unlimited projects) |
When to Use Each
When to use NuGet Audit (dotnet list package --vulnerable)
NuGet Audit (dotnet list package --vulnerable) is the right choice when:
- You work exclusively in .NET/NuGet and want a zero-install, SDK-native check
- You want the check embedded directly in
dotnet build/dotnet restoreoutput with no external account - Your CI already runs
dotnetcommands and adding a flag is simpler than a new integration
When to use GeekWala
GeekWala is the better fit when:
- You need to prioritize by real-world exploit probability, not CVSS severity alone
- You want CISA KEV (confirmed active exploitation) flagged as its own field
- You manage projects across multiple ecosystems, not just NuGet/.NET
- You want a web dashboard and scan history instead of re-running a CLI command
Detection vs Prioritization
EPSS Exploit Probability
NuGet Audit's own output shows a severity tier (Low/Moderate/High/Critical) with CVSS via the linked GHSA, with no exploit-probability signal. GeekWala layers EPSS on OSV advisory data for the same NuGet ecosystem, so exploitation probability — not just theoretical severity — drives what you fix first.
CISA KEV Alongside EPSS
NuGet Audit does not indicate CISA KEV status — a confirmed actively-exploited CVE looks identical to a theoretical High-severity one in its report. GeekWala flags KEV entries as a separate field on every finding, ranked first.
Built to Run Alongside NuGet Audit, Not Replace It
dotnet list package --vulnerable in CI for a zero-cost, SDK-native check on every build; GeekWala for cross-ecosystem, EPSS/KEV-enriched triage and a web dashboard.
Learn More
Frequently Asked Questions
Is GeekWala a NuGet Audit replacement?
Not necessarily — NuGet Audit is free, built into the .NET SDK, and requires no separate account, so it stays useful for zero-cost CI checks. GeekWala adds EPSS exploit-probability and CISA KEV enrichment for triage, plus a hosted dashboard and 7 ecosystems beyond NuGet. Many teams run both.
How do I run NuGet Audit?
Run dotnet list package --vulnerable from a project directory with .NET SDK 5.0.200 or later installed; add --include-transitive to also check indirect dependencies. Requirements and flag behavior per learn.microsoft.com/en-us/dotnet/core/tools/dotnet-package-list.
Does NuGet Audit check transitive (indirect) dependencies by default?
It depends on your target framework: projects targeting .NET 10 or higher default to checking all dependencies (direct and transitive); earlier target frameworks default to direct-only unless you pass --include-transitive or configure the <NuGetAuditMode> property.
How does GeekWala prioritization differ from NuGet Audit?
NuGet Audit's report groups findings into four severity tiers (Low/Moderate/High/Critical) linked to a GitHub Security Advisory with CVSS scoring — a measure of theoretical impact, not likelihood of exploitation. GeekWala ranks the same OSV-sourced findings by CISA KEV (confirmed active exploitation) first, then EPSS score above 10% (30-day exploit probability), then severity, with EPSS breaking ties.
Is GeekWala free like NuGet Audit?
GeekWala has a free tier with 5 projects and 50 scans per month. NuGet Audit is fully free, built into the .NET SDK, with no usage limits — for NuGet-only projects that never need multi-ecosystem coverage or exploit-probability prioritization, NuGet Audit alone may be enough.
Try GeekWala free
No credit card required. Keep NuGet Audit in your .NET build and add EPSS + CISA KEV prioritization on top.