npm & PyPI Package Health + Vulnerability Check (OSV)

What does the npm & PyPI Package Health + Vulnerability Check do?

It checks npm and PyPI packages, or a whole package.json or requirements.txt, and tells you for each one:

• Vulnerabilities: known vulnerabilities (CVE and GHSA advisories from OSV.dev) with severity and fix versions.
• The version to upgrade to, one that clears every vulnerability found in your version.
• Deprecated or yanked releases, and whether you're behind the latest version.
• License, repository, last update, and popularity (weekly npm downloads).

No API key and no install: paste your dependencies and click Start. Because it runs on Apify, you can schedule a weekly dependency health check and send the results to Slack, email, or a spreadsheet.

Why use it?

• Catch vulnerable dependencies before they ship, including in projects without a CI security scanner.
• Get the answer, not just the alert. Advisories filed under different IDs (GHSA, PYSEC, CVE) are merged into one issue, with the worst severity and the version that fixes it.
• Spot abandoned packages. Deprecated npm packages and yanked PyPI releases are flagged.
• Vet a package before adopting it: its license, maintenance activity, and popularity in one row.
• Give AI coding agents a dependency check they can call through MCP.

How to use it

1. Open the Input tab.
2. List packages (lodash@4.17.15, requests==2.19.0, pypi:numpy), or paste a package.json or requirements.txt.
3. Optional: turn on Save only problems.
4. Click Start. Use the Packages view for the summary, or Vulnerabilities for one row per issue.

Input

Field	What it does
Packages	name@version (npm), name==version (PyPI), or a npm: / pypi: prefix. No version means the latest release is checked.
package.json / requirements.txt	Paste the file. npm ranges (^4.17.15) are checked at their minimum version; == pins are checked exactly.
Ecosystem for bare names	npm or PyPI.
Include devDependencies	For package.json.
Save only problems	Save only vulnerable, deprecated, or not-found packages. Clean ones aren't charged.

{
  "packages": ["lodash@4.17.15", "requests==2.19.0"],
  "requirementsTxt": "urllib3==1.24.1\nflask\n",
  "onlyVulnerable": true
}

Output

One row per package. You can download the dataset in various formats such as JSON, HTML, CSV, or Excel.

{
  "ecosystem": "npm",
  "name": "minimist",
  "checkedVersion": "1.2.0",
  "latestVersion": "1.2.8",
  "outdated": true,
  "deprecated": null,
  "vulnerabilityCount": 2,
  "worstSeverity": "CRITICAL",
  "upgradeTo": "1.2.6",
  "vulnerabilities": [
    {
      "id": "GHSA-xvch-5gv4-984h",
      "cves": ["CVE-2021-44906"],
      "severity": "CRITICAL",
      "summary": "Prototype Pollution in minimist",
      "fixedIn": ["0.2.4", "1.2.6"],
      "url": "https://osv.dev/vulnerability/GHSA-xvch-5gv4-984h"
    }
  ],
  "license": "MIT",
  "repository": "https://github.com/minimistjs/minimist",
  "weeklyDownloads": 70000000
}

A SUMMARY record counts the packages that are vulnerable, critical, high, deprecated, outdated, and not found.

Data fields

Field	Description
checkedVersion, latestVersion, outdated	The version checked, and whether a newer release exists
vulnerabilityCount, worstSeverity, vulnerabilities	Merged advisories: ID, CVEs, severity, CVSS vector, summary, fixed versions, link
upgradeTo	The smallest version that fixes every vulnerability found in the checked version. null means no fix exists, so consider replacing the package.
deprecated	The npm deprecation message, or the PyPI yank reason
license, repository, homepage, lastModified, versionCount, weeklyDownloads, requiresPython	Package health facts

How much does it cost to scan dependencies?

You pay per package checked and saved. With Save only problems, clean packages cost nothing. Set a maximum charge per run in the run options, and the Actor stops cleanly at that limit.

Use it from AI agents (MCP)

AI agents can find and run this Actor through the Apify MCP server.

• Claude, ChatGPT, or any MCP client: add https://mcp.apify.com?tools=creativefour/package-vulnerability-check as a custom connector, and sign in to Apify when prompted.
• Claude Code, Cursor, VS Code, or Codex: run apify mcp install claude-code (swap in your client's name), then ask your agent to "check my package.json for vulnerable dependencies with creativefour/package-vulnerability-check".

FAQ and support

Where does the data come from? From the official npm registry and PyPI JSON APIs, and from vulnerability data from OSV.dev, which aggregates sources such as the GitHub Advisory Database and the PyPA Advisory Database (CC-BY 4.0).

Does it check transitive (nested) dependencies? Not yet. It checks the packages you list, or your direct dependencies. For full trees, paste the resolved versions from your lock file.

Is a clean result a guarantee? No. It covers publicly known vulnerabilities in OSV at the time of the run.

Found a bug or need a feature? Open an issue on the Issues tab. Custom versions are available on request.