Package Vulnerability Check - OSV for npm, PyPI, Maven

Package Vulnerability Check - OSV + deps.dev for npm, PyPI, Maven, Go

Does this dependency version have known vulnerabilities, and what version fixes them? Give ecosystem:name@version and get a compact answer built from public sources:

• OSV.dev: known vulnerabilities from GitHub Security Advisories, PyPA, the Go vulnerability DB, RustSec and more, with IDs, CVE aliases, severity, summaries and fixed versions.
• deps.dev (optional): license, deprecation, publish date, source repo, stars and the OpenSSF Scorecard score.
• An overall riskLevel: high if any HIGH or CRITICAL vulnerability is found, medium for other vulnerabilities or a deprecated version, unknown when there are no advisories and deps.dev does not recognise the package/version (often a typo), otherwise low. unknown needs deps.dev coverage, so for Packagist a misspelled package shows as low. Severity comes only from the GitHub advisory severity (database_specific.severity); advisories without one count as medium.

Ecosystems: npm, PyPI, Maven, Go, crates.io (Cargo), NuGet, RubyGems and Packagist. deps.dev data covers npm, PyPI, Maven, Go, Cargo, NuGet and RubyGems (not Packagist).

Input examples

npm:lodash@4.17.15
PyPI:requests@2.19.0
maven:org.apache.logging.log4j:log4j-core@2.14.1
go:golang.org/x/net@v0.0.1
@babel/core@7.0.0        (uses the default ecosystem)

Without a version, every known vulnerability for the package is listed.

Example output

{ "package": "lodash", "ecosystem": "npm", "version": "4.17.15", "riskLevel": "high", "vulnCount": 6, "maxSeverity": "HIGH",
  "cves": ["CVE-2020-8203", "..."], "fixedVersions": ["4.17.19", "4.17.21"], "licenses": ["MIT"], "scorecardScore": 7.5 }

fixedVersions lists every fixed version across advisories, including backport branches (e.g. log4j 2.3.1/2.12.2); it is not one safe upgrade target.

How much does it cost?

$0.003 per package ($3 per 1,000). No subscription. Invalid specs and failed lookups are free. Set a maximum total charge per run and the Actor stops at your budget.

On Apify's free plan, the $5 monthly usage credit covers up to about 1,600 packages a month (less if you use other Apify Actors or services).

How does it work?

It uses the public OSV.dev and deps.dev APIs only (anonymous, no keys), at low concurrency with one polite retry, and caches project lookups. It doesn't download or execute your code, and no personal data is collected. Severity comes from the advisory database where it's provided (GitHub advisories); some advisories have none.

Every row has a rowId, stable per input item. In the rare case a dataset save times out after the row was stored, an uncharged error row with the same rowId follows; keep the non-error row for each rowId.

Data sources and attribution

Vulnerability data from OSV.dev (osv.dev), aggregated from sources including the GitHub Advisory Database, PyPI Advisory Database and Go Vulnerability Database (CC-BY 4.0) and the RustSec Advisory Database (CC0 1.0). Each advisory keeps its source's license, and summaries are shortened. License, deprecation, repository and OpenSSF Scorecard data come from deps.dev (Open Source Insights, Google). deps.dev-generated data is CC-BY 4.0, and API use is subject to the Google APIs Terms of Service. This Actor is not affiliated with or endorsed by Google, OSV.dev, deps.dev or the OpenSSF.

Use from AI agents (Apify MCP)

Add https://mcp.apify.com?tools=lentic_labs/package-vulnerability-check to your MCP client and ask "Is log4j-core 2.14.1 safe? What should I upgrade to?"

Related

CVE exploit check (CISA KEV + EPSS): see whether those CVEs are actually being exploited.