# npm & PyPI Package Health + Vulnerability Check (OSV) (`creativefour/package-vulnerability-check`) Actor

Check npm and PyPI packages, or a whole package.json or requirements.txt, for known vulnerabilities (CVEs from OSV.dev), the safe version to upgrade to, deprecated or yanked releases, outdated versions, license, and popularity. No API key needed.

- **URL**: https://apify.com/creativefour/package-vulnerability-check.md
- **Developed by:** [CreativeFour LLC](https://apify.com/creativefour) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$5.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

### What does the npm & PyPI Package Health + Vulnerability Check do?

It checks **npm and PyPI packages**, or a whole **package.json** or **requirements.txt**, and tells you for each one:

- **Vulnerabilities:** known vulnerabilities (CVE and GHSA advisories from **OSV.dev**) with severity and fix versions.
- **The version to upgrade to**, one that clears every vulnerability found in your version.
- **Deprecated or yanked releases**, and whether you're **behind the latest version**.
- **License, repository, last update, and popularity** (weekly npm downloads).

No API key and no install: paste your dependencies and click Start. Because it runs on Apify, you can schedule a weekly dependency health check and send the results to Slack, email, or a spreadsheet.

### Why use it?

- **Catch vulnerable dependencies** before they ship, including in projects without a CI security scanner.
- **Get the answer, not just the alert.** Advisories filed under different IDs (GHSA, PYSEC, CVE) are merged into one issue, with the worst severity and the version that fixes it.
- **Spot abandoned packages.** Deprecated npm packages and yanked PyPI releases are flagged.
- **Vet a package before adopting it**: its license, maintenance activity, and popularity in one row.
- **Give AI coding agents a dependency check** they can call through MCP.

### How to use it

1. Open the **Input** tab.
2. List packages (`lodash@4.17.15`, `requests==2.19.0`, `pypi:numpy`), or paste a **package.json** or **requirements.txt**.
3. Optional: turn on **Save only problems**.
4. Click **Start**. Use the **Packages** view for the summary, or **Vulnerabilities** for one row per issue.

### Input

| Field | What it does |
|---|---|
| **Packages** | `name@version` (npm), `name==version` (PyPI), or a `npm:` / `pypi:` prefix. No version means the latest release is checked. |
| **package.json / requirements.txt** | Paste the file. npm ranges (`^4.17.15`) are checked at their minimum version; `==` pins are checked exactly. |
| **Ecosystem for bare names** | npm or PyPI. |
| **Include devDependencies** | For package.json. |
| **Save only problems** | Save only vulnerable, deprecated, or not-found packages. Clean ones aren't charged. |

```json
{
  "packages": ["lodash@4.17.15", "requests==2.19.0"],
  "requirementsTxt": "urllib3==1.24.1\nflask\n",
  "onlyVulnerable": true
}
```

### Output

One row per package. You can download the dataset in various formats such as JSON, HTML, CSV, or Excel.

```json
{
  "ecosystem": "npm",
  "name": "minimist",
  "checkedVersion": "1.2.0",
  "latestVersion": "1.2.8",
  "outdated": true,
  "deprecated": null,
  "vulnerabilityCount": 2,
  "worstSeverity": "CRITICAL",
  "upgradeTo": "1.2.6",
  "vulnerabilities": [
    {
      "id": "GHSA-xvch-5gv4-984h",
      "cves": ["CVE-2021-44906"],
      "severity": "CRITICAL",
      "summary": "Prototype Pollution in minimist",
      "fixedIn": ["0.2.4", "1.2.6"],
      "url": "https://osv.dev/vulnerability/GHSA-xvch-5gv4-984h"
    }
  ],
  "license": "MIT",
  "repository": "https://github.com/minimistjs/minimist",
  "weeklyDownloads": 70000000
}
```

A **SUMMARY** record counts the packages that are vulnerable, critical, high, deprecated, outdated, and not found.

### Data fields

| Field | Description |
|---|---|
| `checkedVersion`, `latestVersion`, `outdated` | The version checked, and whether a newer release exists |
| `vulnerabilityCount`, `worstSeverity`, `vulnerabilities` | Merged advisories: ID, CVEs, severity, CVSS vector, summary, fixed versions, link |
| `upgradeTo` | The smallest version that fixes every vulnerability found in the checked version. `null` means no fix exists, so consider replacing the package. |
| `deprecated` | The npm deprecation message, or the PyPI yank reason |
| `license`, `repository`, `homepage`, `lastModified`, `versionCount`, `weeklyDownloads`, `requiresPython` | Package health facts |

### How much does it cost to scan dependencies?

You pay per package checked and saved. With **Save only problems**, clean packages cost nothing. Set a **maximum charge per run** in the run options, and the Actor stops cleanly at that limit.

### Use it from AI agents (MCP)

AI agents can find and run this Actor through the [Apify MCP server](https://docs.apify.com/integrations/mcp).

- **Claude, ChatGPT, or any MCP client:** add `https://mcp.apify.com?tools=creativefour/package-vulnerability-check` as a custom connector, and sign in to Apify when prompted.
- **Claude Code, Cursor, VS Code, or Codex:** run `apify mcp install claude-code` (swap in your client's name), then ask your agent to "check my package.json for vulnerable dependencies with creativefour/package-vulnerability-check".

### FAQ and support

**Where does the data come from?** From the official npm registry and PyPI JSON APIs, and from vulnerability data from [OSV.dev](https://osv.dev), which aggregates sources such as the GitHub Advisory Database and the PyPA Advisory Database (CC-BY 4.0).

**Does it check transitive (nested) dependencies?** Not yet. It checks the packages you list, or your direct dependencies. For full trees, paste the resolved versions from your lock file.

**Is a clean result a guarantee?** No. It covers publicly known vulnerabilities in OSV at the time of the run.

**Found a bug or need a feature?** Open an issue on the **Issues** tab. Custom versions are available on request.

# Actor input Schema

## `packages` (type: `array`):

One per line: lodash@4.17.15, @scope/name@1.2.3, requests==2.19.0, or prefix with npm: / pypi:. Without a version, the latest release is checked.

## `packageJson` (type: `string`):

Paste a package.json. Dependency ranges are checked at their minimum version (for example ^4.17.15 checks 4.17.15).

## `requirementsTxt` (type: `string`):

Paste a requirements.txt. Pinned versions (==) are checked exactly; >= and ~= use the lower bound; bare names use the latest release.

## `defaultEcosystem` (type: `string`):

Used when a line has no npm:/pypi: prefix and no == version.

## `includeDevDependencies` (type: `boolean`):

When checking a pasted package.json.

## `onlyVulnerable` (type: `boolean`):

Save only packages with known vulnerabilities, deprecated or yanked versions, or that weren't found. Clean packages are counted in the summary but not saved (or charged).

## Actor input object example

```json
{
  "packages": [
    "lodash@4.17.15",
    "requests==2.19.0",
    "express"
  ],
  "defaultEcosystem": "npm",
  "includeDevDependencies": true,
  "onlyVulnerable": false
}
```

# Actor output Schema

## `results` (type: `string`):

No description

## `summary` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "packages": [
        "lodash@4.17.15",
        "requests==2.19.0",
        "express"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("creativefour/package-vulnerability-check").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "packages": [
        "lodash@4.17.15",
        "requests==2.19.0",
        "express",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("creativefour/package-vulnerability-check").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "packages": [
    "lodash@4.17.15",
    "requests==2.19.0",
    "express"
  ]
}' |
apify call creativefour/package-vulnerability-check --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,creativefour/package-vulnerability-check"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/VDIfmD6YgZBKTha8N/builds/MQC6Gh5bfRGA3IpYL/openapi.json