Pricing

Pay per usage

Try for free

Go to Apify Store

OSV Scraper: Open-Source Package Vulnerabilities

Try for free

Look up known vulnerabilities for npm, PyPI, Go, Maven, crates.io and other open-source packages via the OSV.dev API: severity, affected version ranges and fixed versions. No login, no proxy, no browser.

Pricing

Pay per usage

Rating

0.0

(0)

Developer

Naimur Hasan

Actor stats

Bookmarked

Total users

Monthly active users

9 days ago

Last modified

OSV Scraper

Looks up known vulnerabilities for open-source packages through OSV.dev, the distributed vulnerability database covering npm, PyPI, Go, Maven, crates.io, NuGet, Packagist, RubyGems, Debian, Alpine and more. No login, no proxy, no browser.

Input

Field	Type	Notes
`packages`	array	Required. `"ecosystem:name"` per line. Default: lodash, django, gin.
`minSeverity`	string	`any` \| `LOW` \| `MODERATE` \| `HIGH` \| `CRITICAL`. Default `any`.
`maxPerPackage`	integer	Cap on advisories per package. Default `50`.

Output

One row per advisory: package, ecosystem, packageName, id, aliases, cves, summary, severity, cvss, cweIds, introducedVersions, fixedVersions, isFixed, published, modified, advisoryUrl.

Notes

One advisory can name several packages. A lodash advisory also lists lodash.trim, lodash.trimend and so on, each with its own version ranges. Reading affected[0] gives you the version range for whichever package happened to be listed first — this Actor matches the entry against the package actually queried.
introduced: "0" is a sentinel meaning "every version from the start", not a real version number. It is dropped rather than reported as version 0.
Advisories with no severity rating are never filtered out. A missing rating means nobody has scored it yet, not that it is harmless, so minSeverity only excludes advisories that carry a lower explicit rating.
isFixed: false is the column worth sorting on — it marks advisories with no released fix for the queried package.
Ecosystem names are case-sensitive in OSV: npm, PyPI, Go, Maven, crates.io.

OSV Open Source Vulnerabilities Scraper

parseforge/osv-vulnerabilities-scraper

Scrapes open source vulnerability records from the OSV catalogue by package, version, commit, or vulnerability ID. Returns each advisory as a flat row with aliases, affected versions, and severity scores.

ParseForge

OSV Scraper | Open-Source Package Vulnerabilities (CVE)

muzafferkadir/osv-vulnerabilities-scraper

Look up known security vulnerabilities (CVE/GHSA) for open-source packages — npm, PyPI, Go, Maven & more — via the official OSV.dev API: severity, references, dates. No API key.

Muzaffer Kadir YILMAZ

OSV Vulnerability Scraper - Package Security Advisories

thirdwatch/osv-vulnerability-scraper

Find known vulnerabilities for npm, PyPI, Maven, Go, NuGet, Cargo, RubyGems, and other packages. Export advisory IDs, affected versions, fixes, severity, references, and source links.

Thirdwatch

Open Source Vulnerability Scraper (OSV.dev)

chrisp1211/vulnerability-scraper-max

Look up open-source security vulnerabilities from OSV.dev for any package across npm, PyPI, Go, Maven, crates and more. Returns CVE IDs, severity, summary and references. No API key. Pay per vulnerability; empty runs free.

Christian Pichichero

UK Carbon Intensity Scraper: Grid CO2 & Fuel Mix

naimurhasanrwd/carbonintensity-uk-scraper

Pull GB electricity carbon intensity and generation mix from the National Grid ESO Carbon Intensity API, nationally or per DNO region. No login, no proxy, no browser.

Naimur Hasan

OSV-Scanner Vulnerability Checker

ayeeyee/osv-scanner-vulnerability-checker

Scan a git repository dependency manifests, package-lock.json, requirements.txt, go.sum, and more, against Google OSV.dev vulnerability database using OSV-Scanner. Get cross-ecosystem CVE matching across npm, PyPI, Go, Maven, and other package registries. $0.49 per completed scan.