Dependency Vulnerability & License Audit — OSV, CISA KEV and EPSS Priority

Audit the dependencies of any project and get a ranked to-fix list instead of a wall of CVEs. Point the Actor at a GitHub repo, a lockfile URL, a pasted package.json / requirements.txt / go.mod, or a plain package list. For every package it returns known vulnerabilities from OSV.dev, flags the ones actively exploited in the wild (CISA KEV), adds the EPSS exploit probability, names the minimum version that fixes everything, and checks licenses against your policy. No API key, no login.

Most scanners rank by CVSS alone, so a lockfile with 40 "high" findings looks the same as one with a single actively exploited bug. Here every package gets a priority: P0 actively exploited (CISA KEV), P1 critical or likely to be exploited (EPSS ≥ 10%), P2 high severity, P3 other, none clean.

What you get

One row per package:

Field	Description
ecosystem, package_name, version	What was audited. Ecosystems: npm, PyPI, Go, crates.io
version_source	pinned (lockfile / ==), range-minimum (lowest version of a range such as ^1.2.0), or explicit
priority	P0 / P1 / P2 / P3 / none (see above)
vulnerability_count, max_severity	Distinct advisories (GHSA/CVE aliases merged) and the worst severity
in_kev, max_epss	Listed in the CISA Known Exploited Vulnerabilities catalog; highest EPSS probability
recommended_version	Lowest version that fixes the advisories OSV has a fix for
vulnerabilities[]	Per advisory: id, cve, severity, summary, fixed_in, epss, in_kev, url
licenses, license_status	SPDX licenses from deps.dev; ok, blocked (matches your policy) or unknown
latest_version, is_outdated, is_deprecated, published_at	Freshness signals

A SUMMARY record in the key-value store rolls the run up: counts by priority, blocked-license packages, deprecated packages and the top upgrade steps. It is free.

Input

Field	Description
githubRepos	owner/name. Reads package-lock.json (else package.json), requirements.txt, go.mod, Cargo.lock from the default branch root
manifestUrls	Raw URLs of those files (works for private files behind a tokenised URL)
manifestText + manifestFileName	Paste one manifest
packages	npm:lodash@4.17.15, pypi:requests==2.19.0, go:github.com/gin-gonic/gin@v1.6.0, cargo:serde@1.0.100
includeDevDependencies	Off by default
blockedLicenses	SPDX ids to block. Default: AGPL, GPL-3.0, SSPL, BUSL
onlyRisky	Deliver and pay for risky packages only
maxPackages	Cap per run (default 300)

Example: audit a repo, show only what needs attention

{
  "githubRepos": ["expressjs/express"],
  "onlyRisky": true
}

Pricing

Pay per event: $0.01 per run plus $0.0015 per package delivered. A 300-package lockfile costs about $0.46; with onlyRisky you pay only for the packages that need attention. The run stops at your maximum cost limit.

Notes

• Sources: OSV.dev (advisories), deps.dev (licenses, versions), CISA KEV, FIRST EPSS.
• Matching is by exact version. For package.json ranges the lowest version of the range is audited (version_source: range-minimum); use a lockfile for the exact installed tree.
• Dual-licensed packages (MIT OR GPL-3.0) list both licenses; review blocked_licenses_found before acting.
• It reports known advisories only; it does not check whether your code reaches the vulnerable function. Not legal or security advice.