Open-Source Package Check: Vulnerabilities and License

Check PyPI, npm, Go, Cargo, Maven, NuGet or RubyGems packages before you depend on them: known vulnerabilities from OSV.dev with CVE aliases, severity and fixed-in versions, plus license, latest version and deprecation from deps.dev. Pay per package; unknown packages are free.

What you get

Given an open-source package (PyPI, npm, Go, Cargo, Maven, NuGet or RubyGems) and optionally a version, returns its known vulnerabilities from OSV.dev (IDs, CVE aliases, severity, fixed-in versions), license, latest version, publish date and deprecation status from deps.dev, plus a one-line recommendation. For coding agents to call before adding or upgrading a dependency. Not charged if the package or version does not exist.

Input

• packages (Packages): ecosystem:name or ecosystem:name@version (ecosystems: pypi, npm, go, cargo, maven, nuget, rubygems). Up to 200 per run.

Example output (real run)

{
  "ecosystem": "pypi",
  "name": "requests",
  "version": "2.25.0",
  "latest_version": "2.34.2",
  "is_latest": false,
  "published_at": "2020-11-11",
  "deprecated": false,
  "deprecated_reason": null,
  "licenses": [
    "Apache-2.0"
  ],
  "vulnerability_count": 8,
  "vulnerability_count_is_lower_bound": false,
  "max_severity": "MODERATE",
  "vulnerabilities": [
    {
      "id": "GHSA-9hjg-9r4m-mvj7",
      "aliases": [
        "CVE-2024-47081",
        "PYSEC-2026-1872"
      ],
      "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs",
      "severity": "MODERATE",
      "published": "2025-06-09",
      "fixed_in": [
        "2.32.4"
      ],
      "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"
    },
    {
      "id": "GHSA-9wx4-h78v-vm56",
      "aliases": [
        "CVE-2024-35195",
        "PYSEC-2026-1873"
      ],
      "summary": "Requests `Session` object does not verify requests after making first request with verify=False",
      "severity": "MODERATE",
      "published": "2024-05-20",
      "fixed_in": [
        "2.32.0"
      ],
      "url": "https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56"
    },
    {
      "id": "GHSA-gc5v-m9x4-r6x2",
      "aliases": [
        "CVE-2026-25645",
        "PYSEC-2026-2275"
      ],
      "summary": "Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function",
      "severity": "MODERATE",
      "published": "2026-03-25",
      "fixed_in": [
        "2.33.0"
      ],
      "url": "https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2"
    },
    {
      "id": "GHSA-j8r2-6x86-q33q",
      "aliases": [
        "CVE-2023-32681",
        "PYSEC-2023-74"
      ],
      "summary": "Unintended leak of Proxy-Authorization header in requests",
      "severity": "MODERATE",
      "published": "2023-05-22",
      "fixed_in": [
        "2.31.0"
      ],
      "url": "https://osv.dev/vulnerability/GHSA-j8r2-6x86-q33q"
    },
    {
      "id": "PYSEC-2023-74",
      "aliases": [
        "CVE-2023-32681",
        "GHSA-j8r2-6x86-q33q"
      ],
      "summary": null,
      "severity": null,
      "published": "2023-05-26",
      "fixed_in": [
        "74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5",
        "2.31.0"
      ],
      "url": "https://osv.dev/vulnerability/PYSEC-2023-74"
    },
    {
      "id": "PYSEC-2026-1872",
      "aliases": [
        "CVE-2024-47081",
        "GHSA-9hjg-9r4m-mvj7"
      ],
      "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs",
      "severity": null,
      "published": "2026-07-07",
      "fixed_in": [
        "2.32.4"
      ],
      "url": "https://osv.dev/vulnerability/PYSEC-2026-1872"
    },
    {
      "id": "PYSEC-2026-1873",
      "aliases": [
        "CVE-2024-35195",
        "GHSA-9wx4-h78v-vm56"
      ],
      "summary": "Requests `Session` object does not verify requests after making first request with verify=False",
      "severity": null,
      "published": "2026-07-07",
  
  ...

Sources and attribution

OSV.dev (CC-BY 4.0) and deps.dev (CC-BY 4.0).

Pricing

Pay per event: $0.003 per package (event package-checked). Inputs that fail, are not found or hit a source outage are saved as not_charged rows and cost nothing. Set a maximum charge on the run and the Actor stops there.

About

Built by Agent Harbor LLC. The same lookup is available to AI agents pay-per-call over x402 (USDC on Base) at https://x402.agentharbor.agency.