Dependency Vulnerability Check (OSV) for npm, PyPI, Go, Maven
Pricing
from $3.00 / 1,000 package checkeds
Dependency Vulnerability Check (OSV) for npm, PyPI, Go, Maven
Paste package@version pins or a requirements.txt / package.json; get known vulnerabilities, malicious-package flags, severity and fixed versions per package from the OSV.dev database. Built for agents and CI.
Pricing
from $3.00 / 1,000 package checkeds
Rating
0.0
(0)
Developer
Blake Runckel
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
17 hours ago
Last modified
Categories
Share
Dependency Vulnerability Check (OSV): npm, PyPI, Go, Maven, Cargo and more
Give it a list of pinned packages, or paste a requirements.txt or package.json. For each package@version it returns the known vulnerabilities from the OSV.dev database: OSV/GHSA/CVE IDs, severity, versions that fix each issue, and a flag for known-malicious packages (OpenSSF MAL- records). One row per package, JSON-ready for agents, CI jobs and LLM tool calls.
Input
| Field | Description |
|---|---|
packages | One per line: ecosystem:name@version. Examples: npm:lodash@4.17.20, pypi:requests==2.19.0, go:github.com/gin-gonic/gin@v1.6.0, maven:org.apache.logging.log4j:log4j-core@2.14.1, crates.io:time@0.1.0. |
defaultEcosystem | Used for lines without a prefix. |
requirementsTxt | Optional. Only pinned name==version lines are checked. |
packageJson | Optional. dependencies and devDependencies. A range such as ^4.17.20 is checked as the stated version 4.17.20, not the version your lockfile resolved. |
Ecosystems: npm, PyPI, Go, crates.io, Maven, RubyGems, NuGet, Packagist, Pub, Hex, CRAN.
Output (per package)
ecosystem, name, version, vulnerable, vulnCount, maliciousPackage, highestSeverity, fixedVersions, highestFixedVersion, vulnsWithoutFixAbove, vulns[{id, aliases, summary, severity, fixedIn, published, modified, url, malicious}], checkedAt, source
Lines that can't be parsed are not output or charged. They are listed in the run log and in the UNPARSED record of the run's key-value store.
Limits, read before relying on this
- It checks exactly the versions you give. It does not resolve lockfiles or transitive dependencies. Use a lockfile (pinned versions) for the best results.
fixedInlists fixed versions above your version, taken from OSV ranges. A package can be on several release branches, sohighestFixedVersionis the newest fix across them. It is not always the smallest safe upgrade.severityis the label that the source database gives (for example, GHSA's). Many records have none, and then it isnull. No severity is inferred.- No result means no record in OSV. It does not mean the package is safe.
- Linux distribution feeds (Ubuntu, Chainguard/Wolfi) are excluded because of their licences (ShareAlike / NonCommercial-NoDerivatives).
Pricing
Pay per event: $0.003 per package checked (one dataset row), plus Apify's standard tiny Actor-start event. Unparsed lines are free.
Source and terms
Data comes from the public OSV.dev API (https://api.osv.dev, run by Google; its docs say it has no rate limits). OSV has no single licence. Each record keeps its source's licence, mostly CC-BY 4.0 (GitHub Advisory Database, PyPI, Go, OSS-Fuzz) and otherwise CC0, MIT or Apache-2.0 (https://google.github.io/osv.dev/data/). Each result links to its record on osv.dev for attribution. Summaries are cut to 200 characters, and the full advisory text is not copied. This Actor is not affiliated with or endorsed by Google, OSV or GitHub.
Built by Ledger. Issues and requests go to the Issues tab.
