Package Dependency Risk Scanner: npm & PyPI Vulnerabilities

Check a software package for problems before you depend on it. Give npm or PyPI package names; for each it reads the registry metadata (latest version, last publish, license, deprecation, npm weekly downloads) and queries OSV.dev for known security advisories, then composes a risk brief with a clear signal. Keyless, agent-callable, built to answer "is this dependency vulnerable, deprecated, or abandoned?"

📋 Advisories, not a verdict. Vulnerabilities come from OSV.dev (official GHSA/CVE data) and are reported verbatim — a signal to review and verify against the source, not a judgement that a package is unsafe or advice not to use it.

⚡ Why it's useful

One call turns a dependency name into the three things that actually bite: known CVEs/GHSAs, whether it's deprecated, and whether it's stale/abandoned — the answer, not raw registry JSON.

📋 What each brief contains

Field	Meaning
signal	known-vulnerabilities--review / deprecated / stale--check-maintenance / no-known-issues
vulnerabilities	OSV advisories affecting the checked version: id (GHSA), aliases (CVE), severity (CVSS), summary
vulnerabilityCount	How many advisories affect the checked version
checkedVersion / latestVersion	The version queried (your version or latest) and the registry latest
ageDaysSinceLastPublish	Staleness signal
deprecated / deprecatedReason	Registry deprecation (npm) or yank (PyPI)
weeklyDownloads / license	npm weekly downloads and the declared license

📥 Input

{ "packages": ["lodash", "express@4.18.0", "pypi:requests", "npm:@babel/core"], "ecosystem": "npm" }

Prefix a name with npm: or pypi: to pick the ecosystem; add @version (npm) or ==version (PyPI) to check a specific version. One brief per package.

📤 Example output (real run, trimmed)

{
  "ecosystem": "npm", "name": "lodash", "checkedVersion": "4.17.4", "latestVersion": "4.17.21",
  "signal": "known-vulnerabilities--review", "vulnerabilityCount": 10, "weeklyDownloads": 162267012,
  "vulnerabilities": [
    {"id": "GHSA-29mw-wpgm-hmr9", "severity": "CVSS:3.1/.../A:L", "summary": "Regular Expression Denial of Service (ReDoS) in lodash"},
    {"id": "GHSA-35jh-r3h4-6jhm", "severity": "CVSS:3.1/.../A:H", "summary": "Command Injection in lodash"}
  ]
}

In the same run express and pypi:requests returned no-known-issues, and left-pad came back deprecated (last published ~8 years ago).

💰 Pricing (pay-per-event)

• Package scanned — $0.02 per package found. Packages that don't resolve are free.

💡 Use cases

• Developers / security / platform teams: vet a dependency (or a list) for CVEs, deprecation and abandonment.
• Due diligence / audits: a fast risk read across a company's stated dependencies.
• CI / agents: callable as an MCP tool — feed package names, get back a risk signal.

🔑 Keyless & agent-callable

No API keys, no accounts, no paid child Actors — just the public npm registry, PyPI, and OSV.dev.

🚀 Ready-made tasks (one click)

• npm Package Vulnerability Check - CVEs & Health

🤖 For AI agents (MCP)

https://mcp.apify.com/?tools=actors,docs,centorprat/package-dependency-risk-scanner

Loads as centorprat--package-dependency-risk-scanner. Claude Code:

claude mcp add apify -- npx -y @apify/actors-mcp-server --actors centorprat/package-dependency-risk-scanner