# Package Vulnerability Check - OSV for npm, PyPI, Maven (`lentic_labs/package-vulnerability-check`) Actor

Check package@version for known vulnerabilities (OSV.dev: GitHub advisories, PyPA, Go, RustSec...) with severity, CVEs and fixed versions, plus optional deps.dev license, deprecation and OpenSSF Scorecard. npm, PyPI, Maven, Go, Cargo, NuGet, RubyGems, Packagist. MCP-ready. $3 per 1,000 packages.

- **URL**: https://apify.com/lentic_labs/package-vulnerability-check.md
- **Developed by:** [Lentic Labs](https://apify.com/lentic_labs) (community)
- **Categories:** Developer tools, Automation
- **Features:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $3.00 / 1,000 packages

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Package Vulnerability Check - OSV + deps.dev for npm, PyPI, Maven, Go

**Does this dependency version have known vulnerabilities, and what version fixes them?** Give `ecosystem:name@version` and get a compact answer built from public sources:

- **[OSV.dev](https://osv.dev)**: known vulnerabilities from GitHub Security Advisories, PyPA, the Go vulnerability DB, RustSec and more, with IDs, CVE aliases, severity, summaries and **fixed versions**.
- **[deps.dev](https://deps.dev)** (optional): license, deprecation, publish date, source repo, stars and the **OpenSSF Scorecard** score.
- An overall `riskLevel`: `high` if any HIGH or CRITICAL vulnerability is found, `medium` for other vulnerabilities or a deprecated version, `unknown` when there are no advisories and deps.dev does not recognise the package/version (often a typo), otherwise `low`. `unknown` needs deps.dev coverage, so for Packagist a misspelled package shows as `low`. Severity comes only from the GitHub advisory severity (`database_specific.severity`); advisories without one count as `medium`.

Ecosystems: npm, PyPI, Maven, Go, crates.io (Cargo), NuGet, RubyGems and Packagist. deps.dev data covers npm, PyPI, Maven, Go, Cargo, NuGet and RubyGems (not Packagist).

### Input examples

```
npm:lodash@4.17.15
PyPI:requests@2.19.0
maven:org.apache.logging.log4j:log4j-core@2.14.1
go:golang.org/x/net@v0.0.1
@babel/core@7.0.0        (uses the default ecosystem)
```

Without a version, every known vulnerability for the package is listed.

### Example output

```json
{ "package": "lodash", "ecosystem": "npm", "version": "4.17.15", "riskLevel": "high", "vulnCount": 6, "maxSeverity": "HIGH",
  "cves": ["CVE-2020-8203", "..."], "fixedVersions": ["4.17.19", "4.17.21"], "licenses": ["MIT"], "scorecardScore": 7.5 }
```

`fixedVersions` lists every fixed version across advisories, including backport branches (e.g. log4j 2.3.1/2.12.2); it is not one safe upgrade target.

### How much does it cost?

**$0.003 per package ($3 per 1,000).** No subscription. Invalid specs and failed lookups are free. Set a maximum total charge per run and the Actor stops at your budget.

On Apify's free plan, the $5 monthly usage credit covers up to about 1,600 packages a month (less if you use other Apify Actors or services).

### How does it work?

It uses the public OSV.dev and deps.dev APIs only (anonymous, no keys), at low concurrency with one polite retry, and caches project lookups. It doesn't download or execute your code, and no personal data is collected. Severity comes from the advisory database where it's provided (GitHub advisories); some advisories have none.

Every row has a `rowId`, stable per input item. In the rare case a dataset save times out after the row was stored, an uncharged `error` row with the same `rowId` follows; keep the non-error row for each `rowId`.

### Data sources and attribution

Vulnerability data from OSV.dev (osv.dev), aggregated from sources including the GitHub Advisory Database, PyPI Advisory Database and Go Vulnerability Database (CC-BY 4.0) and the RustSec Advisory Database (CC0 1.0). Each advisory keeps its source's license, and summaries are shortened. License, deprecation, repository and OpenSSF Scorecard data come from deps.dev (Open Source Insights, Google). deps.dev-generated data is CC-BY 4.0, and API use is subject to the Google APIs Terms of Service. This Actor is not affiliated with or endorsed by Google, OSV.dev, deps.dev or the OpenSSF.

### Use from AI agents (Apify MCP)

Add `https://mcp.apify.com?tools=lentic_labs/package-vulnerability-check` to your MCP client and ask *"Is log4j-core 2.14.1 safe? What should I upgrade to?"*

### Related

[CVE exploit check (CISA KEV + EPSS)](https://apify.com/lentic_labs/cve-kev-epss-lookup): see whether those CVEs are actually being exploited.

# Actor input Schema

## `packages` (type: `array`):

One per line as ecosystem:name@version, e.g. npm:lodash@4.17.15, PyPI:requests@2.19.0, maven:org.apache.logging.log4j:log4j-core@2.14.1, go:golang.org/x/net@v0.0.1. Without a version, all known vulnerabilities for the package are listed.

## `defaultEcosystem` (type: `string`):

Used for entries without an 'ecosystem:' prefix.

## `includeDepsDev` (type: `boolean`):

Add license, deprecation, source repo and OpenSSF Scorecard score from deps.dev (npm, PyPI, Maven, Go, Cargo, NuGet; needs a version).

## `maxConcurrency` (type: `integer`):

Packages checked in parallel (kept low to be polite to the public APIs).

## Actor input object example

```json
{
  "packages": [
    "npm:lodash@4.17.15",
    "PyPI:requests@2.19.0",
    "maven:org.apache.logging.log4j:log4j-core@2.14.1"
  ],
  "defaultEcosystem": "npm",
  "includeDepsDev": true,
  "maxConcurrency": 4
}
```

# Actor output Schema

## `results` (type: `string`):

Default dataset, overview view.

## `summary` (type: `string`):

Counts: packages checked, packages with known vulnerabilities.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "packages": [
        "npm:lodash@4.17.15",
        "PyPI:requests@2.19.0",
        "maven:org.apache.logging.log4j:log4j-core@2.14.1"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("lentic_labs/package-vulnerability-check").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "packages": [
        "npm:lodash@4.17.15",
        "PyPI:requests@2.19.0",
        "maven:org.apache.logging.log4j:log4j-core@2.14.1",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("lentic_labs/package-vulnerability-check").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "packages": [
    "npm:lodash@4.17.15",
    "PyPI:requests@2.19.0",
    "maven:org.apache.logging.log4j:log4j-core@2.14.1"
  ]
}' |
apify call lentic_labs/package-vulnerability-check --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,lentic_labs/package-vulnerability-check"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/X2hjYmjBkj95xjqlD/builds/r2nwGd5c7Ath7JIZ3/openapi.json