Pricing

$3.00 / 1,000 package records

Try for free

Go to Apify Store

OSS Package Risk Checker - npm, PyPI, Cargo, Maven

Try for free

Check npm, PyPI, Cargo, Go, Maven and NuGet packages for known vulnerabilities (OSV), licenses, OpenSSF Scorecard, downloads, deprecation and outdated versions, with a 0-100 risk score.

Pricing

$3.00 / 1,000 package records

Rating

0.0

(0)

Developer

Andres Barcelo

Actor stats

Bookmarked

Total users

Monthly active users

6 days ago

Last modified

Open-Source Package Risk Checker (npm, PyPI, Cargo, Go, Maven, NuGet)

Audit open-source dependencies in one run. For each ecosystem:name[@version] you get license, known vulnerabilities, OpenSSF Scorecard, repo stars, monthly downloads, deprecation, latest-version gap and a 0-100 risk score with reasons, combined from:

deps.dev (Google Open Source Insights) - versions, licenses, source repo, OpenSSF Scorecard, stars
OSV.dev - known vulnerabilities (GHSA, CVE, PYSEC, RUSTSEC...) for the exact version
npm / pypistats - monthly download counts

Use cases

License compliance & SBOM review before release or M&A due diligence
Vet a new dependency in seconds; bulk-audit a package.json / requirements.txt
Scheduled monitoring for newly disclosed vulnerabilities in pinned versions
Give AI coding agents (via MCP/API) a trustworthy package-health signal

Input

{"packages": ["npm:express", "npm:lodash@4.17.15", "pypi:requests@2.19.0", "cargo:serde", "maven:org.apache.logging.log4j:log4j-core@2.14.1"]}

Without @version the latest default version is checked.

Output (one item per package)

{"ecosystem":"npm","package":"lodash","version":"4.17.15","latestVersion":"4.17.21","isLatest":false,"licenses":["MIT"],
 "vulnerabilityCount":3,"vulnerabilityIds":["GHSA-29mw-wpgm-hmr9","..."],"advisorySeverities":["HIGH","MODERATE"],
 "sourceRepo":"github.com/lodash/lodash","openssfScorecard":5.6,"monthlyDownloads":200000000,"riskScore":55,"riskLevel":"HIGH",
 "riskReasons":["3 known vulnerabilities","high/critical advisory","not latest version"]}

Pricing

Pay per result: charged only for successfully checked packages (not-found entries are free).

Data from public open APIs (deps.dev, OSV.dev, npm registry, pypistats). Not affiliated with Google, OpenSSF, npm or PyPI.

📦 npm Package Scraper - Downloads & Dependencies

benthepythondev/npm-package-scraper

Extract npm package data with download stats, dependencies, maintainers, and quality scores. Search by keyword, author, or get popular packages. Perfect for JavaScript ecosystem research, competitor tracking, and dependency analysis. Fast API-based extraction, pay-per-result.

Ben

Package Intelligence for npm and PyPI

agentictools/package-intelligence

Track npm and PyPI packages: download stats, versions, dependencies, license, and repository. For dependency monitoring and developer marketing.

Ken Agland

npm & PyPI Package Scraper — Downloads, Health & Maintenance

samwise.agency/package-intel

Package intelligence for npm and PyPI: download stats, publish recency, maintenance scores, license and repo metadata. Find abandoned dependencies, benchmark libraries, monitor your stack. Official APIs, keyless.

samwise.agency

Dependency Release Risk Monitor

q_services/dependency-release-risk-monitor

Monitor npm and PyPI packages for new releases, outdated versions, deprecation, licenses and OSV vulnerabilities.

Q Services

OSS Supply Chain Risk Report - PyPI, npm, OSV and Docker Hub

changeable_peddler/oss-supply-chain-risk-report

Software supply chain risk API and requirements.txt security scanner for Python packages, npm packages, Docker images, lockfiles, SBOMs, and Dockerfiles.

Sean J

npm, PyPI & crates.io Package Intelligence

optirefine/package-intelligence

Bulk package health, vulnerabilities and dependency data for npm, PyPI and crates.io. One row per package: version, licence, maintainers, downloads, OSV advisories, deps.dev dependency counts, and a 0-100 health score.

OptiRefine

NPM Package Risk Auditor

ezzatox/npm-package-risk-auditor

Audit public npm packages for maintenance, deprecation, download, license, dependency, and supply-chain risk signals.

Ezzat Ghazi

OSS Package Health & Vulnerability API

ai-coding-radar/oss-package-health-monitor

Scan installed npm and PyPI versions for OSV vulnerabilities and CISA KEV matches. Compare checked vs latest versions, licenses, repositories, and npm downloads in JSON, CSV, or Excel. Transparent source status; no login, token, proxy, or private package access.

AI Coding Radar

NuGet Package Stats

brunofin/nuget-package-stats

Fetch NuGet (.NET) package metadata and statistics: version, total downloads, authors, license, dependencies, and release history via the official NuGet API.

Bruno Finger

npm & PyPI Package Monitor — Versions & Downloads

vertaizen/package-registry-monitor

Monitor npm & PyPI packages via the open registry APIs — latest version, publish date, monthly downloads, dependencies & maintainers. Monitor mode returns only CHANGES: new versions & download swings. Supply-chain security, devtools & investor signals. Pay per package.