OSS Package Health & Vulnerability API

An npm and PyPI version vulnerability scanner API for dependency health checks, SBOM triage, release review, and AI-agent workflows. Each output row combines registry metadata, npm's last-week download count, OSV vulnerability records, and CISA's Known Exploited Vulnerabilities (KEV) matches. The Actor uses only public official HTTP APIs: no login, cookies, API key, CAPTCHA bypass, proxy rotation, or private dependency access is required.

• Run the Actor on Apify
• Try the exact-version CVE scan example
• Import the n8n exact-version scan
• Follow the n8n and Make setup recipe

Search terms this Actor is designed for:

npm vulnerability scanner, PyPI vulnerability scanner, OSV API, CISA KEV, package metadata API, dependency health report, and SBOM vulnerability check.

What it does

• Reads npm package metadata from the npm Registry and PyPI metadata from PyPI's JSON API.
• Reads npm downloads from npm's public downloads API. PyPI download counts are intentionally marked not_supported in this MVP rather than guessed.
• Validates an optional installed version in npm or PyPI, compares it with the latest release, and queries OSV.dev for vulnerabilities affecting that exact version. Omit version to check the latest release.
• Matches CVE aliases against the CISA KEV catalog.
• Emits a visible status, sourceStatus, errors, and warnings for every package. If OSV fails, vulnerabilities is null; it is never changed to an empty array to hide a failed check.

This is an evidence collector, not a security certification, legal opinion, or guarantee that a package is safe. A clean row means the queried public sources reported no matching record for that version at that time.

Copy-paste REST quickstart

Keep an Apify API token in your secret manager, then send a complete input instead of the empty placeholder shown by some generated API clients:

curl -sS -X POST \
  'https://api.apify.com/v2/acts/ai-coding-radar~oss-package-health-monitor/run-sync-get-dataset-items?clean=1' \
  -H "Authorization: Bearer $APIFY_API_TOKEN" \
  -H 'Content-Type: application/json' \
  --data '{"packages":[{"name":"lodash","ecosystem":"npm","version":"4.17.20"}],"includeDownloads":true,"includeVulnerabilities":true,"includeRepository":true,"includeCisaKev":true}'

The generated API client's empty {} input is also safe: it checks only the two public package/version examples from the Store schema. Use the explicit payload above when you want to control exactly which records are billed.

Input

{
  "packages": [
    {"name": "lodash", "ecosystem": "npm", "version": "4.17.20"},
    {"name": "requests", "ecosystem": "PyPI", "version": "2.19.0"}
  ],
  "includeDownloads": true,
  "includeVulnerabilities": true,
  "includeRepository": true,
  "includeCisaKev": true
}

Up to 50 unique package/ecosystem/version combinations are accepted. Supported ecosystems are npm and PyPI. Each optional version must be an exact registry version, not a range such as ^4.17.0; unresolved versions fail closed and are not sent to OSV as an unscoped package query.

Output

Each package produces one dataset row. A successful no-vulnerability response has vulnerabilities: [], vulnerabilityCount: 0, and sourceStatus.osv: "ok". A failed OSV response has vulnerabilities: null, vulnerabilityCount: null, and sourceStatus.osv: "error", with a human-readable error type in errors.

Example (abridged):

{
  "package": "lodash",
  "ecosystem": "npm",
  "status": "ok",
  "requestedVersion": "4.17.20",
  "checkedVersion": "4.17.20",
  "latestVersion": "4.17.21",
  "isLatest": false,
  "weeklyDownloads": 167905798,
  "vulnerabilityCount": 5,
  "cisaKevMatches": [],
  "sourceStatus": {
    "registry": "ok",
    "downloads": "ok",
    "osv": "ok",
    "cisaKev": "ok"
  },
  "errors": [],
  "warnings": []
}

Pricing

The intended primary event is one package-health-record at $0.0015 per returned package, plus $0.00005 per run start. Platform usage is included in that price. This repository does not claim revenue; only a settled payout is income.

Local checks

python3 -m unittest discover -s tests -v
python3 -m compileall -q oss_package_health_monitor
python3 -m oss_package_health_monitor --live-smoke

The live smoke checks react and requests against the public npm Registry, npm downloads, PyPI JSON, OSV, and CISA KEV endpoints. It does not read any credentials. Use --fixture path/to/input.json for an offline run.

GitHub Actions runs the same live smoke once per day at 10:17 Asia/Shanghai (.github/workflows/live-smoke.yml). The scheduled job uses no secrets and fails when any required public source is unavailable; it prints only package status, version, and vulnerability counts.

Limits and attribution

Results are point-in-time API observations, not a legal or security guarantee. Keep the source URLs returned by the APIs when redistributing data. Do not use this Actor to access private packages or to make automatic code changes. API outages and rate limits remain visible in each row and must be handled by the caller.