Check a package-lock.json for known CVEs

Created by

Dennis

Actor

Container CVE Matcher

Paste package-lock.json → exact CVE/GHSA, CVSS, fixed version per dependency — verified against installed version. (~160)

Try for free

Container CVE Matchercodeclouds/container-cve-matcher

Record type

Scanned input

Package

Ecosystem

+16 fields

Input

Inline lockfiles / SBOMs

Filename(required):package-lock.json

Content(required):{"lockfileVersion":3,"packages":{"":{"name":"my-app"},"node_modules/lodash":{"version":"4.17.15"}}}

Output fields

Record type

Scanned input

Package

Ecosystem

Version

Installed version

Ecosystem supported

Checked against OSV

Matches

OSV/GHSA ID

CVE ID

Severity

CVSS score

Patched in

Summary

Highest severity (run)

Total matches (run)

Dependencies checked (run)

Dependency note

Run error

How it works

Sign up on Apify or log in

The Container CVE Matcher Actor is ready to run with the inputs already set for "Check a package-lock.json for known CVEs". Sign up or log in and you'll land in Apify Console with a copy of this exact task.

Start the "Check a package-lock.json for known CVEs" task

The Container CVE Matcher Actor will start running based on the input automatically. You can also change all the input fields, like inline lockfiles / sboms, to match your specific use case.

Receive the "Check a package-lock.json for known CVEs" output

Monitor the progress in real time. You will be notified as soon as your dataset is complete and ready for review. Each result includes data such as record type, scanned input, package, and more.

Integrate into your workflow

The final output is delivered in JSON, CSV, or Excel format, ready to be plugged into your workflow. You can also run the "Check a package-lock.json for known CVEs" task via API.