OSV Package Vulnerability Monitor

Monitor package watchlists against OSV.dev and get structured vulnerability records for remediation, SBOM review, and dependency-risk workflows.

This Actor is for security teams, MSPs, developer-platform teams, and software agencies that need to check public package names from lockfiles, SBOM exports, or customer inventories. It supports OSV ecosystems such as npm, PyPI, Go, Maven, crates.io, and RubyGems.

What It Does

• Checks package names and optional versions against the public OSV API
• Emits vulnerability IDs, CVE aliases, summaries, affected ranges, and fixed versions
• Marks records as new, modified, or unchanged across scheduled runs
• Produces dataset rows, high-priority exports, a buyer brief, and Slack-ready alerts
• Works without credentials

Input

{
  "packages": [
    { "name": "lodash", "ecosystem": "npm" },
    { "name": "django", "ecosystem": "PyPI" },
    { "name": "org.apache.logging.log4j:log4j-core", "ecosystem": "Maven" }
  ],
  "maxVulnerabilitiesPerPackage": 5,
  "compareToPreviousRun": true,
  "dryRun": false
}

Output

Each row includes package, ecosystem, optional version, OSV ID, aliases, priority, summary, affected ranges, fixed versions, references, source URL, and change state.

{
  "recordType": "osv_package_vulnerability_match",
  "packageName": "lodash",
  "ecosystem": "npm",
  "vulnerabilityId": "GHSA-29mw-wpgm-hmr9",
  "aliases": ["CVE-2020-28500"],
  "changeType": "new_vulnerability",
  "priority": "high",
  "fixedVersions": ["4.17.21"],
  "sourceUrl": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9"
}

Why Use This

Generic CVE feeds are awkward when the input you actually have is a package list. This Actor uses package-first OSV lookups and returns fixed-version hints that are easier to route into dependency remediation workflows.

Pricing

Recommended Apify pricing is pay per event:

• osv-vulnerability-match: $0.003 per emitted vulnerability record
• Dry runs are free
• Free-plan users get the first 25 live records without this Actor's custom event charge

Compliance Notes

This Actor uses public OSV.dev data. Results should be verified against your lockfiles, SBOMs, deployed versions, vendor advisories, and internal remediation policy.