# Dependency Vulnerability Scanner: CVE, KEV, EPSS (`maliksaid/dependency-vulnerability-audit`) Actor

Scan npm, PyPI, Maven, Go and other package versions for CVE vulnerabilities with OSV. A dependency security audit and CVE lookup with one row per package: worst severity, CVE IDs, CISA KEV flag, EPSS score, fixed version and end of life status. Reads package.json and requirements.txt.

- **URL**: https://apify.com/maliksaid/dependency-vulnerability-audit.md
- **Developed by:** [Malik Said](https://apify.com/maliksaid) (community)
- **Categories:** Developer tools, Automation, AI
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per event

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Dependency Vulnerability Scanner: CVE, KEV, EPSS

This dependency vulnerability scanner checks package versions for known CVE vulnerabilities. You get one row per package. Each row shows the vulnerability count, the worst severity, CVE IDs, the CISA KEV flag, the highest EPSS score, the fixed version and the end-of-life status.

Use it for dependency security audits, reviews of a new codebase, vendor due diligence and scheduled alerts. AI agents can call it with a list of packages and read one clear row per package.

### Dependency vulnerability sources

| Source | What it adds |
|---|---|
| [OSV.dev](https://osv.dev) | Known vulnerabilities (GHSA, PYSEC, GO, RUSTSEC and others) with CVE aliases, severity and fixed versions |
| [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | Whether a CVE is known to be exploited, and whether it is used in ransomware campaigns |
| [FIRST EPSS](https://www.first.org/epss/) | Probability that a CVE is exploited in the next 30 days |
| [endoflife.date](https://endoflife.date) | End-of-life and support dates for runtimes, frameworks, databases and operating systems |

Ecosystems: npm, PyPI, Maven, Go, NuGet, crates.io, RubyGems, Packagist, Pub and Hex.

On 21 October 2026 the CISA KEV catalog held 1,754 CVEs and endoflife.date tracked 485 products.

### Vulnerability data returned

| Field | Meaning |
|---|---|
| `type` | `package` for a package version, `product` for an end-of-life check |
| `ecosystem`, `name`, `version` | The package version that was checked |
| `vulnCount` | Known vulnerabilities for this version. Advisories that share an alias (for example a GHSA and a PYSEC record for the same CVE) count once |
| `worstSeverity` | CRITICAL, HIGH, MEDIUM, LOW, UNKNOWN, or NONE when nothing is known |
| `maxCvssScore` | Highest CVSS v3 base score |
| `vulnIds`, `cveIds` | Advisory IDs and their CVE aliases |
| `inKev`, `kevCveIds`, `kevRansomware` | CISA KEV matches |
| `maxEpss`, `maxEpssPercentile`, `maxEpssCve` | Highest EPSS score and its CVE |
| `fixedVersion` | Lowest version above yours that OSV lists as fixed for every vulnerability with a fix |
| `unfixedVulnCount` | Vulnerabilities with no fixed version above yours |
| `vulnerabilities` | One entry per vulnerability with summary, severity, CVSS, fix, KEV and EPSS. Sorted by KEV, then EPSS, then severity |
| `latestVersion`, `license`, `deprecated`, `deprecationMessage` | Latest version, license and deprecation flag from the npm and PyPI registries (input `includePackageInfo`, on by default). Empty for other ecosystems |
| `eolProduct`, `eolCycle`, `isEol`, `eolDate`, `activeSupportEnds`, `isMaintained`, `latestInCycle`, `latestCycle` | endoflife.date status for the version's release cycle |
| `errors` | Problems while checking the row |

Empty values:

- End-of-life fields are null when endoflife.date does not track the package. It tracks about 30 npm packages and a few hundred products.
- `maxEpss` is null when no CVE of the package has an EPSS score.
- `cvssScore` is null when the advisory has only a CVSS v4 vector or no vector.
- Product rows have null vulnerability fields.

### How to use the vulnerability scanner

1. Add packages, one per line, as `ecosystem:name@version`. For example `npm:lodash@4.17.15` or `PyPI:django@3.2.0`. Package URLs such as `pkg:npm/lodash@4.17.15` also work.
2. Or paste a `package.json`, `package-lock.json` or `requirements.txt`.
3. Add products for end-of-life checks, for example `nodejs@18`, `python@3.8` or `ubuntu@20.04`.
4. Run the Actor. Sort by `inKev` and `maxEpss` to see what to fix first.
5. Turn on **Monitor mode** and schedule the Actor. You then get a row only when a package gets a new advisory, a KEV listing or an end-of-life change.

| Option | Default | Meaning |
|---|---|---|
| Packages | Sample list | One package version per line |
| package.json or package-lock.json | None | From package.json, the base version of each range is checked (`^4.17.1` becomes `4.17.1`). Tags such as `latest` are skipped |
| requirements.txt | None | Lines pinned with `==` are checked. Other lines are skipped and listed in the log |
| Include devDependencies | On | Check dev dependencies too |
| Products | Sample list | endoflife.date product name and version |
| Check end-of-life status | On | Add endoflife.date data |
| Check CISA KEV | On | Add the KEV flag |
| Add EPSS scores | On | Add EPSS scores |
| Only packages at risk | Off | Save only rows with a vulnerability or an end-of-life release |
| Monitor mode | Off | Return a row only when its findings change |
| Monitor state key | `default` | Name of the monitor memory. Use one per project |
| Maximum rows | 100 | Stop after this many rows. Set 0 for no limit |

### Dependency audit pricing

The Actor uses pay-per-event pricing.

| Event | Price |
|---|---|
| Actor start | $0.02 per run at the default 256 MB memory (one event per GB, minimum one) |
| Package checked | $0.002 per package or product row saved to the dataset |

So 500 packages cost about $1 plus the start fee. Rows skipped by "Only packages at risk" or by monitor mode cost nothing. Duplicate packages in the input are checked once. The Pricing tab always shows the current price.

### Input and output example

Input from a real run on 21 October 2026:

```json
{
  "packages": ["npm:lodash@4.17.15", "npm:jquery@3.4.0", "PyPI:requests@2.25.0", "npm:minimist@1.2.5"],
  "maxItems": 3
}
```

The first output row from that run (lists shortened, one of six vulnerabilities shown):

```json
{
  "type": "package",
  "ecosystem": "npm",
  "name": "lodash",
  "version": "4.17.15",
  "vulnCount": 6,
  "unfixedVulnCount": 0,
  "worstSeverity": "HIGH",
  "maxCvssScore": 8.1,
  "cveIds": ["CVE-2020-28500", "CVE-2020-8203", "CVE-2021-23337", "CVE-2025-13465"],
  "inKev": false,
  "kevRansomware": false,
  "maxEpss": 0.21333,
  "maxEpssPercentile": 0.97583,
  "maxEpssCve": "CVE-2021-23337",
  "fixedVersion": "4.18.0",
  "vulnerabilities": [
    {
      "id": "GHSA-35jh-r3h4-6jhm",
      "cveIds": ["CVE-2021-23337"],
      "summary": "Command Injection in lodash",
      "severity": "HIGH",
      "cvssScore": 7.2,
      "fixedVersion": "4.17.21",
      "inKev": false
    }
  ],
  "eolProduct": null,
  "osvUrl": "https://osv.dev/list?ecosystem=npm&q=lodash",
  "errors": []
}
```

### Dependency vulnerability FAQ

#### How is this different from npm audit?

npm audit covers npm only. This Actor covers ten ecosystems in one run. It also adds the CISA KEV flag, EPSS scores and end-of-life dates.

#### Does it install or run my packages?

No. The Actor reads only the package names and versions you give it. It sends them to the OSV API.

#### What does the CISA KEV flag mean?

CISA lists CVEs that attackers already exploit. A package with `inKev: true` should be fixed first.

#### How exact are versions from package.json?

A version range is checked at its lowest version. Use package-lock.json for the exact installed versions.

#### Can I look up a single CVE?

The Actor works per package version. Every row lists the CVE IDs of that version with severity, KEV and EPSS data.

#### Can AI agents use it?

Yes. The input is a short list of `ecosystem:name@version` strings. The output is flat JSON with one row per package.

### Data sources and use

- All four sources are free public APIs that need no login or key.
- OSV advisory data comes from many databases under their own licenses, mostly CC-BY 4.0. EPSS asks for attribution: scores come from FIRST.org EPSS. endoflife.date data is MIT licensed. CISA KEV is a US government work.

### Related Actors

- [Technical SEO Audit](https://apify.com/maliksaid/technical-seo-audit): crawl a website and find technical SEO problems.
- [Regulator Circulars Monitor](https://apify.com/maliksaid/regulator-circulars-monitor): track new circulars from the Central Bank of Jordan and the Saudi National Cybersecurity Authority.

### Support

Report a problem in the Issues tab. Include the run link.

# Actor input Schema

## `packages` (type: `array`):

One package version per line. Use ecosystem:name@version, for example npm:lodash@4.17.15, PyPI:django@3.2.0 or Maven:org.apache.logging.log4j:log4j-core@2.14.1. Package URLs such as pkg:npm/lodash@4.17.15 also work. Ecosystems: npm, PyPI, Maven, Go, NuGet, crates.io, RubyGems, Packagist, Pub, Hex. Leave every input empty to check a small sample list.

## `packageJson` (type: `string`):

Paste the content of a package.json or package-lock.json file. From package.json the Actor uses the base version of each range, so ^4.17.1 is checked as 4.17.1. A package-lock.json gives the exact installed versions.

## `requirementsTxt` (type: `string`):

Paste the content of a Python requirements.txt file. The Actor checks lines pinned with == (for example django==3.2.0) and skips the rest.

## `includeDevDependencies` (type: `boolean`):

Check devDependencies from package.json and dev packages from package-lock.json.

## `products` (type: `array`):

Runtimes, frameworks, databases or operating systems to check on endoflife.date. Use the endoflife.date product name and a version, for example nodejs@18, python@3.8, postgresql@12, ubuntu@20.04 or php@7.4.

## `checkEol` (type: `boolean`):

Add endoflife.date status to products and to packages that endoflife.date tracks (for example django, express, angular, spring-boot).

## `includeKev` (type: `boolean`):

Flag CVEs that are in the CISA Known Exploited Vulnerabilities catalog.

## `includePackageInfo` (type: `boolean`):

Read the latest version, license and deprecation flag from the public npm and PyPI registries. PyPI yanked releases count as deprecated. Other ecosystems return empty fields.

## `includeEpss` (type: `boolean`):

Add the FIRST EPSS exploit probability for each CVE.

## `onlyAtRisk` (type: `boolean`):

Save only rows with at least one known vulnerability or an end-of-life release. Clean rows are not saved and not charged.

## `monitorMode` (type: `boolean`):

Return a package or product only when its advisories, KEV status or end-of-life status changed since earlier monitor-mode runs with the same state key. Schedule the Actor with this on to get alerts.

## `stateKey` (type: `string`):

Name of the memory that monitor mode uses. Use a different key for each project.

## `maxItems` (type: `integer`):

Stop after saving this many rows. Set 0 for no limit.

## Actor input object example

```json
{
  "packages": [
    "npm:lodash@4.17.15",
    "npm:express@4.17.1",
    "PyPI:django@3.2.0",
    "Maven:org.apache.logging.log4j:log4j-core@2.14.1",
    "Go:github.com/gin-gonic/gin@1.6.0"
  ],
  "includeDevDependencies": true,
  "products": [
    "nodejs@16",
    "python@3.8"
  ],
  "checkEol": true,
  "includeKev": true,
  "includePackageInfo": true,
  "includeEpss": true,
  "onlyAtRisk": false,
  "monitorMode": false,
  "stateKey": "default",
  "maxItems": 100
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "packages": [
        "npm:lodash@4.17.15",
        "npm:express@4.17.1",
        "PyPI:django@3.2.0",
        "Maven:org.apache.logging.log4j:log4j-core@2.14.1",
        "Go:github.com/gin-gonic/gin@1.6.0"
    ],
    "products": [
        "nodejs@16",
        "python@3.8"
    ],
    "maxItems": 100
};

// Run the Actor and wait for it to finish
const run = await client.actor("maliksaid/dependency-vulnerability-audit").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "packages": [
        "npm:lodash@4.17.15",
        "npm:express@4.17.1",
        "PyPI:django@3.2.0",
        "Maven:org.apache.logging.log4j:log4j-core@2.14.1",
        "Go:github.com/gin-gonic/gin@1.6.0",
    ],
    "products": [
        "nodejs@16",
        "python@3.8",
    ],
    "maxItems": 100,
}

# Run the Actor and wait for it to finish
run = client.actor("maliksaid/dependency-vulnerability-audit").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "packages": [
    "npm:lodash@4.17.15",
    "npm:express@4.17.1",
    "PyPI:django@3.2.0",
    "Maven:org.apache.logging.log4j:log4j-core@2.14.1",
    "Go:github.com/gin-gonic/gin@1.6.0"
  ],
  "products": [
    "nodejs@16",
    "python@3.8"
  ],
  "maxItems": 100
}' |
apify call maliksaid/dependency-vulnerability-audit --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,maliksaid/dependency-vulnerability-audit"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/3n9thSDzIbYF6il5P/builds/NbFHGw9KP4d9KWVIb/openapi.json