Package Vulnerabilities Scanner - OSV (npm, PyPI, Maven, Go)
Pricing
$0.50 / 1,000 package checkeds
Check open source packages or a lockfile against the OSV vulnerability database. One result per package: known vulnerabilities with CVE/GHSA ids, severity, fixed versions and a recommended upgrade. Free of API keys.
Packages to check, each with the EXACT version installed. Either an object {"ecosystem", "name", "version"} or a text line such as "npm lodash 4.17.15", "PyPI django==3.2.0", "Maven org.apache.logging.log4j:log4j-core 2.14.1" or a package URL "pkg:npm/lodash@4.17.15". Ecosystems: npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist, Pub, Hex, Hackage, CRAN. A range (^1.2, >=2) or "latest" cannot be checked: you get a free error record telling you so. Names are normalised (PyPI case and underscores, Packagist case, spaces).
Public URLs of dependency files: package-lock.json, package.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, Pipfile.lock, go.mod, Cargo.lock, Gemfile.lock, composer.lock. Use the raw file (GitHub and GitLab "blob" page links are converted to raw automatically). Lockfiles give exact versions and are the best input; package.json and requirements.txt only help for exact pins. Files must be public: a URL that asks for a login returns a free error record.
[ "https://github.com/expressjs/express/blob/4.16.0/package.json"]Paste the content of a dependency file here (up to 8 MB). The format is detected from the content; set "Manifest format" if it cannot be told.
Format of the pasted text (and of URLs whose file name does not tell it). Auto-detect works for almost every file.
Check only packages of these ecosystems and skip the others (useful for a repository with several languages). Empty = all.
Keep only vulnerabilities of at least this severity (low, medium, high, critical). Severity is the CVSS rating computed from the advisory's vector (or the database's own label when there is no vector). Advisories with NO severity at all are kept, because they cannot be shown to be low.
Leave out packages that have no vulnerability to show (clean ones, and ones whose advisories are all under the minimum severity). They are not delivered and not charged. Off by default, because "checked and clean" is a useful answer.
Lockfiles that mark development-only packages (package-lock.json, poetry.lock, Pipfile.lock, composer.lock, package.json). Turn off to check only what ships to production.
OSV already leaves withdrawn advisories out of its answers. If one is withdrawn between the lookup and the read of its details it is dropped here unless this is on.
Add the long description (first 4,000 characters) of each advisory. Off by default to keep results small; every advisory always has its summary and links.
A package that appears several times (in different files or at different places of a lockfile) with the same version is checked and charged once, and lists where it was found. Turn off to get one record per occurrence.