OSV Open Source Vulnerabilities Scraper

Get clean open-source vulnerability data for any package across npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist, Hex & Pub: CVE/GHSA aliases, CVSS severity, affected versions and references. Powered by OSV.dev. As JSON, CSV or Excel. Free, no key, no proxy.

💵 Pricing

Pay per result — ~$1 per 1,000 items. No subscription, no proxy needed. You only pay for the data you scrape, and new Apify accounts include free monthly credits so you can test it for $0.

🔎 What can it extract?

• Vulnerability id (OSV/GHSA) and CVE/GHSA aliases
• Summary and full details
• CVSS severity vector or label (CRITICAL/HIGH/MODERATE/LOW)
• Affected versions (explicit versions + introduced/fixed ranges)
• Package name and ecosystem
• Published / modified dates and reference URLs
• Direct link to osv.dev/vulnerability/{id}

🚀 How do I use it?

1. Click Try for free.
2. Choose a mode: packages (scan package names in an ecosystem) or ids (fetch specific CVE/GHSA/OSV ids).
3. Click Start and download results as JSON, CSV or Excel — or pull them via the API / schedule them.

⚙️ Input example

{
  "mode": "packages",
  "ecosystem": "npm",
  "packageNames": ["lodash", "django"],
  "maxItems": 100
}

By id:

{
  "mode": "ids",
  "vulnIds": ["GHSA-29mw-wpgm-hmr9"]
}

📦 Output example

{
  "id": "GHSA-29mw-wpgm-hmr9",
  "aliases": ["CVE-2020-28500"],
  "package": "lodash",
  "ecosystem": "npm",
  "severity": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "affected_versions": ["introduced: 4.0.0", "fixed: 4.17.21"],
  "url": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9"
}

🎯 Use cases

• Dependency scanning — flag vulnerable packages in your lockfiles
• Security — monitor advisories for the libraries you ship
• SBOM — enrich software bills of materials with known CVEs
• Compliance — evidence for audits and vulnerability reporting

💰 How much will it cost?

You pay only the per-result price (no proxy cost): 100 → ~$0.10 · 1,000 → ~$1 · 10,000 → ~$10

🆚 Why this one

Feature	This actor	Others
10+ ecosystems (npm/PyPI/Go/Maven…)	✅	often one
CVE + GHSA aliases	✅	partial
Affected version ranges	✅	rarely
No key needed	✅	sometimes

🔗 Related actors

• NVD CVE Scraper — NIST CVE feed
• npm Package Scraper — npm metadata
• PyPI Scraper — Python packages
• crates.io Scraper — Rust crates

❓ FAQ

Key/proxy? No — OSV.dev is a free public API. Which ecosystems? npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist, Hex, Pub. How do I look up a specific CVE? Use mode ids with the CVE/GHSA/OSV identifier.

🛟 Support

Found a bug or need an extra field? Open an issue on the actor — fixes and new fields ship fast.

Legal & privacy

Data via the OSV.dev public API (open-source vulnerability database).

---

Keywords: osv scraper, vulnerability scanner, cve scraper, ghsa, dependency scanning, sbom, security, npm pypi go maven, cvss, JSON CSV Excel