# NPM Package Security Scanner - CVE, Typosquat, Supply Chain (`gochujang/npm-package-security-scanner`) Actor

Scan npm packages for security vulnerabilities, supply chain risks, and quality signals. Returns CVE count, maintainer activity, typosquat detection, install script flags, dependency count, license info, and download trends. Uses npm registry and OSV.dev APIs. No API key required.

- **URL**: https://apify.com/gochujang/npm-package-security-scanner.md
- **Developed by:** [Hojun Lee](https://apify.com/gochujang) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 item scanneds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

### What does npm Package Security Scanner do?

**npm package security scanner** audits any npm package for **JavaScript vulnerability** exposure, supply chain risks, and maintenance signals — no API key required. For each package you provide, the actor queries the npm Registry, npm Downloads API, and OSV.dev to compute a composite risk label (`critical`, `high`, `medium`, or `low`), detect known CVEs, flag suspicious install scripts, and identify typosquatting candidates. This **npm CVE checker** works on individual packages or bulk lists of hundreds of packages.

All data sources are free and public. No tokens, no proxies, no rate-limit registration needed.

### Why use npm Package Security Scanner?

- **CI/CD dependency auditing** — integrate this **JavaScript vulnerability audit** into your pull-request pipeline to catch risky packages before they land in production.
- **Supply chain security** — detect `preinstall`, `install`, and `postinstall` scripts that execute arbitrary code during `npm install` before they run in your environment.
- **License compliance** — automatically flag copyleft licenses (GPL, LGPL, AGPL, MPL) that may conflict with your project's commercial licensing requirements.
- **Typosquat detection** — identify packages whose names sit within one edit distance of a popular library, a common attack vector for **npm CVE** injection campaigns.
- **Open-source due diligence** — before adopting a new library, confirm it is actively maintained, not abandoned, and free of critical **JavaScript vulnerability** findings.

### How to use npm Package Security Scanner

1. Open the actor on Apify and click **Try for free**.
2. In the **Input** tab, add your package names to the `packages` array (e.g. `["express", "lodash", "left-pad"]`).
3. Click **Start** — the actor runs sequentially to be respectful of public API rate limits.
4. Review each record's `overall_risk` label and `vuln_severity_max` to prioritize remediation.
5. Export results as JSON or CSV, or connect via the Apify API to automate security gates in CI/CD.

### Input

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `packages` | `string[]` | Yes | — | npm package names to scan (e.g. `express`, `@types/node`) |
| `includeDevDependencies` | `boolean` | No | `false` | Reserved for future use |

Example input:

```json
{
  "packages": ["express", "lodash", "left-pad", "colors"]
}
```

### Output

One record per scanned package, saved to the Apify dataset:

```json
[
  {
    "package": "colors",
    "version": "1.4.0",
    "overall_risk": "high",
    "has_known_vulns": false,
    "vuln_count": 0,
    "vuln_severity_max": null,
    "typosquat_risk": "low",
    "has_install_script": false,
    "is_abandoned": true,
    "days_since_last_publish": 823,
    "maintainer_count": 1,
    "dependency_count": 0,
    "license": "MIT",
    "is_copyleft_license": false,
    "weekly_downloads": 18200000,
    "download_trend": "declining",
    "scanned_at": "2026-09-01T10:00:00+00:00",
    "error": null
  }
]
```

### Data fields

| Field | Type | Description |
|---|---|---|
| `package` | string | npm package name |
| `version` | string | Latest published version |
| `overall_risk` | string | Composite risk label: `critical`, `high`, `medium`, or `low` |
| `has_known_vulns` | boolean | True if OSV.dev reports any known vulnerability |
| `vuln_count` | integer | Number of vulnerabilities from OSV.dev |
| `vuln_severity_max` | string | null | Highest severity: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, or null |
| `typosquat_risk` | string | `high` if name is 1 edit away from a popular package |
| `has_install_script` | boolean | True if `preinstall`/`install`/`postinstall` scripts exist |
| `is_abandoned` | boolean | True if no publish in 365+ days |
| `days_since_last_publish` | integer | Days since the latest version was published |
| `maintainer_count` | integer | Number of registered npm maintainers |
| `dependency_count` | integer | Number of direct `dependencies` |
| `license` | string | SPDX license string |
| `is_copyleft_license` | boolean | True for GPL / LGPL / AGPL / MPL |
| `weekly_downloads` | integer | Downloads in the last 7 days |
| `download_trend` | string | `growing`, `stable`, or `declining` |
| `scanned_at` | ISO8601 | Timestamp of the scan |
| `error` | string | null | Error message if the package could not be scanned |

### Risk classification

| Risk level | Triggers |
|---|---|
| `critical` | OSV.dev reports a vulnerability with HIGH or CRITICAL severity |
| `high` | Typosquatting risk detected OR package abandoned for 365+ days |
| `medium` | Install scripts present (supply chain risk) OR copyleft license detected |
| `low` | None of the above risk signals found |

### Cost estimation

Pricing is **Pay-Per-Event (PPE)** — charged once per package successfully scanned.

| Packages scanned | Cost |
|---|---|
| 10 | $0.05 |
| 100 | $0.50 |
| 500 | $2.50 |
| 1,000 | $5.00 |

### FAQ

**Which vulnerability database does this use?**
The actor queries [OSV.dev](https://osv.dev) — the open-source vulnerability database maintained by Google. It aggregates CVEs, GitHub Security Advisories, and other sources for npm packages. No API key is required.

**Does it scan transitive (indirect) dependencies?**
Currently only direct dependencies are counted via `dependency_count`. Deep transitive scanning is on the roadmap.

**Can I run this on every PR automatically?**
Yes. Use the [Apify Scheduler](https://docs.apify.com/schedules) or trigger runs via the REST API to automate **JavaScript vulnerability audit** checks as part of your CI/CD workflow.

***

> **Disclaimer:** This actor provides security signals based on publicly available data from npm and OSV.dev. Results are for informational purposes and do not constitute a comprehensive security audit. Always verify findings with your security team before making dependency decisions.

***

### Related actors

- [npm Package Trends](https://apify.com/gochujang/npm-package-trends) — Download velocity and bundle size for the same packages you scan for vulnerabilities
- [GitHub Repo Stats](https://apify.com/gochujang/github-repo-stats) — Contributor activity and issue count as additional maintenance signals alongside CVE status
- [Open Source Releases Tracker](https://apify.com/gochujang/open-source-releases-tracker) — Monitor patch releases that fix the vulnerabilities this scanner detects

### Feedback

If this actor helps your supply chain security, a review helps others find it: [Leave a review on Apify Store](https://apify.com/gochujang/npm-package-security-scanner#reviews)

***

**Keywords:** npm security scanner, npm CVE checker, supply chain security, npm vulnerability audit, package security risk, malicious npm package, npm audit API, software composition analysis, SCA tool, open source vulnerability, npm typosquatting, dependency risk assessment, CVSS score npm, npm package integrity, Node.js security

# Actor input Schema

## `packages` (type: `array`):

npm package names to scan (e.g. \['express', 'lodash', 'left-pad'])

## `includeDevDependencies` (type: `boolean`):

Also analyze devDependencies from package.json if provided

## `alertMinSeverity` (type: `string`):

Send Telegram alert for vulnerabilities at this severity or higher.

## `telegramBotToken` (type: `string`):

Telegram bot token for sending alerts (optional).

## `telegramChatId` (type: `string`):

Telegram chat ID to send alerts to (optional).

## Actor input object example

```json
{
  "packages": [
    "express",
    "lodash",
    "axios"
  ],
  "includeDevDependencies": false,
  "alertMinSeverity": "high"
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "packages": [
        "express",
        "lodash",
        "axios"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("gochujang/npm-package-security-scanner").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "packages": [
        "express",
        "lodash",
        "axios",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("gochujang/npm-package-security-scanner").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "packages": [
    "express",
    "lodash",
    "axios"
  ]
}' |
apify call gochujang/npm-package-security-scanner --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,gochujang/npm-package-security-scanner"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/46h03zVvFq4coWpq0/builds/Ocb1S0edYE85l0Ita/openapi.json