NPM Package Security Scanner - CVE, Typosquat, Supply Chain

What does npm Package Security Scanner do?

npm package security scanner audits any npm package for JavaScript vulnerability exposure, supply chain risks, and maintenance signals — no API key required. For each package you provide, the actor queries the npm Registry, npm Downloads API, and OSV.dev to compute a composite risk label (critical, high, medium, or low), detect known CVEs, flag suspicious install scripts, and identify typosquatting candidates. This npm CVE checker works on individual packages or bulk lists of hundreds of packages.

All data sources are free and public. No tokens, no proxies, no rate-limit registration needed.

Why use npm Package Security Scanner?

• CI/CD dependency auditing — integrate this JavaScript vulnerability audit into your pull-request pipeline to catch risky packages before they land in production.
• Supply chain security — detect preinstall, install, and postinstall scripts that execute arbitrary code during npm install before they run in your environment.
• License compliance — automatically flag copyleft licenses (GPL, LGPL, AGPL, MPL) that may conflict with your project's commercial licensing requirements.
• Typosquat detection — identify packages whose names sit within one edit distance of a popular library, a common attack vector for npm CVE injection campaigns.
• Open-source due diligence — before adopting a new library, confirm it is actively maintained, not abandoned, and free of critical JavaScript vulnerability findings.

How to use npm Package Security Scanner

1. Open the actor on Apify and click Try for free.
2. In the Input tab, add your package names to the packages array (e.g. ["express", "lodash", "left-pad"]).
3. Click Start — the actor runs sequentially to be respectful of public API rate limits.
4. Review each record's overall_risk label and vuln_severity_max to prioritize remediation.
5. Export results as JSON or CSV, or connect via the Apify API to automate security gates in CI/CD.

Input

Field	Type	Required	Default	Description
packages	string[]	Yes	—	npm package names to scan (e.g. express, @types/node)
includeDevDependencies	boolean	No	false	Reserved for future use

Example input:

{
  "packages": ["express", "lodash", "left-pad", "colors"]
}

Output

One record per scanned package, saved to the Apify dataset:

[
  {
    "package": "colors",
    "version": "1.4.0",
    "overall_risk": "high",
    "has_known_vulns": false,
    "vuln_count": 0,
    "vuln_severity_max": null,
    "typosquat_risk": "low",
    "has_install_script": false,
    "is_abandoned": true,
    "days_since_last_publish": 823,
    "maintainer_count": 1,
    "dependency_count": 0,
    "license": "MIT",
    "is_copyleft_license": false,
    "weekly_downloads": 18200000,
    "download_trend": "declining",
    "scanned_at": "2026-09-01T10:00:00+00:00",
    "error": null
  }
]

Data fields

Field	Type	Description
package	string	npm package name
version	string	Latest published version
overall_risk	string	Composite risk label: critical, high, medium, or low
has_known_vulns	boolean	True if OSV.dev reports any known vulnerability
vuln_count	integer	Number of vulnerabilities from OSV.dev
vuln_severity_max	string | null	Highest severity: CRITICAL, HIGH, MEDIUM, LOW, or null
typosquat_risk	string	high if name is 1 edit away from a popular package
has_install_script	boolean	True if preinstall/install/postinstall scripts exist
is_abandoned	boolean	True if no publish in 365+ days
days_since_last_publish	integer	Days since the latest version was published
maintainer_count	integer	Number of registered npm maintainers
dependency_count	integer	Number of direct dependencies
license	string	SPDX license string
is_copyleft_license	boolean	True for GPL / LGPL / AGPL / MPL
weekly_downloads	integer	Downloads in the last 7 days
download_trend	string	growing, stable, or declining
scanned_at	ISO8601	Timestamp of the scan
error	string | null	Error message if the package could not be scanned

Risk classification

Risk level	Triggers
critical	OSV.dev reports a vulnerability with HIGH or CRITICAL severity
high	Typosquatting risk detected OR package abandoned for 365+ days
medium	Install scripts present (supply chain risk) OR copyleft license detected
low	None of the above risk signals found

Cost estimation

Pricing is Pay-Per-Event (PPE) — charged once per package successfully scanned.

Packages scanned	Cost
10	$0.05
100	$0.50
500	$2.50
1,000	$5.00

FAQ

Which vulnerability database does this use? The actor queries OSV.dev — the open-source vulnerability database maintained by Google. It aggregates CVEs, GitHub Security Advisories, and other sources for npm packages. No API key is required.

Does it scan transitive (indirect) dependencies? Currently only direct dependencies are counted via dependency_count. Deep transitive scanning is on the roadmap.

Can I run this on every PR automatically? Yes. Use the Apify Scheduler or trigger runs via the REST API to automate JavaScript vulnerability audit checks as part of your CI/CD workflow.

---

Disclaimer: This actor provides security signals based on publicly available data from npm and OSV.dev. Results are for informational purposes and do not constitute a comprehensive security audit. Always verify findings with your security team before making dependency decisions.

---

Related actors

• npm Package Trends — Download velocity and bundle size for the same packages you scan for vulnerabilities
• GitHub Repo Stats — Contributor activity and issue count as additional maintenance signals alongside CVE status
• Open Source Releases Tracker — Monitor patch releases that fix the vulnerabilities this scanner detects

Feedback

If this actor helps your supply chain security, a review helps others find it: Leave a review on Apify Store

---

Keywords: npm security scanner, npm CVE checker, supply chain security, npm vulnerability audit, package security risk, malicious npm package, npm audit API, software composition analysis, SCA tool, open source vulnerability, npm typosquatting, dependency risk assessment, CVSS score npm, npm package integrity, Node.js security