# Open Source Vulnerability Scanner: CVEs for npm, PyPI, Maven (`pankajbhatia/open-source-vulnerability-scanner`) Actor

Find known vulnerabilities (CVE, GHSA) for packages and versions in npm, PyPI, Maven, Go, crates.io, RubyGems, NuGet, Packagist and more, via OSV.dev, with CVSS scores, fixed versions and CISA known-exploited flags.

- **URL**: https://apify.com/pankajbhatia/open-source-vulnerability-scanner.md
- **Developed by:** [Pankaj Bhatia](https://apify.com/pankajbhatia) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 vulnerabilities

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Open Source Vulnerability Scanner: CVEs for npm, PyPI, Maven

Check open-source packages for **known security vulnerabilities**. Enter packages such as `npm:lodash@4.17.15`, `PyPI:django@3.2.0` or `Maven:org.apache.logging.log4j:log4j-core@2.14.1`, and the tool returns every vulnerability that affects that version. Each row includes the ID (GHSA, CVE, PYSEC, RUSTSEC, GO), summary, details, **severity** and a calculated **CVSS v3 base score**, CWE IDs, affected ranges and **fixed versions**, plus a **known-exploited flag** from the CISA KEV catalog (with ransomware use and the remediation due date). Data comes from **OSV.dev**, the open vulnerability database run by Google, which covers npm, PyPI, Maven, Go, crates.io, RubyGems, NuGet, Packagist, Hex, Pub, Debian, Alpine, Ubuntu and more. No login or API key is needed.

### Who is it for?

- **Developers and DevSecOps teams** checking dependencies in CI or before releases.
- **Security analysts** who need to prioritise fixes using CVSS and the CISA exploited list.
- **Compliance and procurement teams** producing vulnerability reports for software they use.
- **Security newsletters and dashboards** that track newly exploited CVEs.

### How to use it

1. List **packages** as `ecosystem:name@version`. Leave out the version to get every known vulnerability for the package.
2. Optionally add **vulnerability IDs** (for example `CVE-2021-44228`) to look them up directly.
3. Optionally set **CISA KEV: added in last N days** to list newly exploited vulnerabilities.
4. Filter by **minimum severity** or **only known exploited**, then click **Start**.

### Input example

```json
{"packages": ["npm:lodash@4.17.15", "PyPI:django@3.2.0"], "minSeverity": "high", "kevAddedLastDays": 30}
```

### Output example

```json
{"id": "GHSA-r5fr-rjxr-66jc", "cveIds": ["CVE-2026-4800"], "package": "lodash", "ecosystem": "npm", "queriedVersion": "4.17.15", "severity": "high", "cvssV3Score": 8.1, "fixedVersions": ["4.18.0"], "knownExploited": false, "url": "https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc"}
```

### How much does it cost?

Pay-per-event: a small fee **per vulnerability** returned, plus a tiny per-run start fee. There is no subscription and no separate platform usage cost. For example, 1,000 vulnerabilities cost about $1. Searches with no matches and error rows are **not charged**. Use **Max results** or **Maximum cost per run** to cap your spending.

### Use it through the API, integrations or AI agents

Run it from the Apify API, on a schedule, or connect it to Make, Zapier, n8n or Google Sheets. AI agents can find and call it through the Apify MCP server. Output is clean JSON with the same fields on every run.

### FAQ

**Is it legal?** Yes. OSV.dev data is published under the **Creative Commons Attribution 4.0** licence through a free public API, and the CISA KEV catalog is U.S. government public data. No personal data is involved.

**Is a package with no results safe?** Not always. No results means no *known* vulnerability is recorded in OSV for that version. Clean packages return a free "no known vulnerabilities" row.

**Why are some severities empty?** Some advisories (often older PYSEC or Go entries) have no CVSS score. GitHub advisories usually do, so the tool puts GHSA entries first and removes duplicates that share the same CVE.

**What package names should I use?** Use the ecosystem's own name, for example `Maven:group:artifact`, `Go:github.com/gin-gonic/gin`, `crates.io:tokio` or `npm:@angular/core`.

**Does it scan my code?** No. It checks the package names and versions you give it.

### More tools from this developer

- [SAM.gov Contract Opportunities Finder & Bid Alerts](https://apify.com/pankajbhatia/sam-gov-contract-opportunities): federal contract opportunities and bid alerts
- [Sitemap & URL Extractor](https://apify.com/pankajbhatia/sitemap-url-extractor): get every URL of a website from its sitemaps
- [Website to Markdown for AI & RAG](https://apify.com/pankajbhatia/website-to-markdown): turn web pages into clean Markdown for LLMs
- [Tech Stack Detector](https://apify.com/pankajbhatia/tech-stack-detector): find what any website is built with
- [Apple App Store Reviews Scraper](https://apify.com/pankajbhatia/app-store-reviews): App Store reviews and ratings for any app
- [ATS Jobs Scraper](https://apify.com/pankajbhatia/ats-jobs-scraper): jobs from Greenhouse, Lever, Ashby, Workable and more
- [Website Screenshot](https://apify.com/pankajbhatia/website-screenshot): full-page, mobile and PDF screenshots in bulk
- [PDF to Text & Markdown Extractor](https://apify.com/pankajbhatia/pdf-text-extractor): extract text from PDFs for AI and search
- [Domain WHOIS, DNS & SSL Checker](https://apify.com/pankajbhatia/domain-whois-dns-ssl-checker): bulk domain, DNS, email security and SSL checks
- [SEO Meta Tags & On-Page Audit](https://apify.com/pankajbhatia/seo-meta-tags-checker): bulk on-page SEO audit with fixes
- [Bulk URL Status & Broken Link Checker](https://apify.com/pankajbhatia/url-status-broken-link-checker): status codes, redirect chains and broken links
- [RSS & Atom Feed Reader](https://apify.com/pankajbhatia/rss-feed-reader): merge and filter many news feeds
- [Hacker News Scraper](https://apify.com/pankajbhatia/hacker-news-scraper): HN stories, comments and Who is hiring jobs
- [Academic Paper Search](https://apify.com/pankajbhatia/academic-paper-search): papers from Crossref, arXiv and PubMed
- [SEC EDGAR Filings & Financials](https://apify.com/pankajbhatia/sec-edgar-filings-financials): 10-K, 10-Q, 8-K filings and company financials
- [Apple Podcasts Scraper](https://apify.com/pankajbhatia/apple-podcasts-scraper): podcast details and full episode lists
- [App Store Top Charts & App Search](https://apify.com/pankajbhatia/app-store-top-charts): top free, paid and grossing app rankings
- [ClinicalTrials.gov Scraper](https://apify.com/pankajbhatia/clinicaltrials-gov-scraper): search and export clinical trials
- [USAspending Federal Awards](https://apify.com/pankajbhatia/usaspending-federal-awards): who won federal contracts and grants
- [Grants.gov Opportunities](https://apify.com/pankajbhatia/grants-gov-opportunities): open and forecasted federal grants
- [Weather Forecast & Alerts](https://apify.com/pankajbhatia/weather-forecast-alerts): 9-day forecasts for any city, plus U.S. alerts
- [EU TED Tenders Scraper](https://apify.com/pankajbhatia/ted-eu-tenders-scraper): European public procurement notices
- [Bulk Domain Availability Checker](https://apify.com/pankajbhatia/bulk-domain-availability-checker): check which domains are free to register
- [Product Recalls Scraper](https://apify.com/pankajbhatia/product-recalls-fda-cpsc-nhtsa): FDA, CPSC and NHTSA vehicle recalls
- [Federal Register Scraper](https://apify.com/pankajbhatia/federal-register-documents): U.S. rules, notices and comment deadlines
- [npm & PyPI Package Stats](https://apify.com/pankajbhatia/npm-pypi-package-stats): downloads, versions and licenses for packages
- [Open Library Books Scraper](https://apify.com/pankajbhatia/open-library-books-scraper): book search and ISBN lookup
- [UK Contracts Finder Scraper](https://apify.com/pankajbhatia/uk-contracts-finder-scraper): UK public tenders and contract awards
- [Wikipedia Scraper](https://apify.com/pankajbhatia/wikipedia-scraper): articles, full text and page views
- [Currency Exchange Rates (ECB)](https://apify.com/pankajbhatia/currency-exchange-rates-ecb): official latest and historical FX rates
- [Barcode Product Lookup](https://apify.com/pankajbhatia/barcode-product-lookup): EAN/UPC barcodes to product and nutrition data
- [Global Company Registry Search (LEI)](https://apify.com/pankajbhatia/gleif-lei-company-search): official company records and parents
- [VIN Decoder (NHTSA)](https://apify.com/pankajbhatia/vin-decoder-nhtsa): bulk vehicle specs from VINs
- [PubMed Scraper](https://apify.com/pankajbhatia/pubmed-scraper): biomedical articles and abstracts
- [US Address Geocoder (Census)](https://apify.com/pankajbhatia/us-census-address-geocoder): lat/long, county and tract for U.S. addresses
- [Remote Jobs Aggregator](https://apify.com/pankajbhatia/remote-jobs-aggregator): remote jobs from Remote OK, Jobicy and Arbeitnow
- [Hugging Face Hub Scraper](https://apify.com/pankajbhatia/hugging-face-hub-scraper): AI models, datasets and Spaces
- [World Bank Indicators](https://apify.com/pankajbhatia/world-bank-indicators): GDP, population and 1,400+ indicators
- [TV Shows & Episodes Scraper](https://apify.com/pankajbhatia/tv-shows-episodes-scraper): TV shows, episodes, cast and schedules
- [WordPress Plugins & Themes Scraper](https://apify.com/pankajbhatia/wordpress-plugins-themes-scraper): plugin and theme installs and ratings
- [US Nonprofit Search (IRS)](https://apify.com/pankajbhatia/us-nonprofit-search-irs): tax-exempt organizations with size and category
- [Music Metadata Scraper (MusicBrainz)](https://apify.com/pankajbhatia/musicbrainz-music-metadata): artists, albums, tracks and ISRCs
- [Package Stats: crates.io, RubyGems, Packagist & NuGet](https://apify.com/pankajbhatia/package-registry-stats): Rust, Ruby, PHP and .NET package stats
- [FDA Drug Labels & NDC Scraper](https://apify.com/pankajbhatia/fda-drug-labels-ndc): official drug labels and NDC codes
- [Public Holidays API](https://apify.com/pankajbhatia/public-holidays-api): holidays and long weekends for 100+ countries
- [US Treasury Rates](https://apify.com/pankajbhatia/us-treasury-rates-yields): Treasury yield curves, T-bill rates and national debt
- [USGS Earthquake Search](https://apify.com/pankajbhatia/usgs-earthquake-search): worldwide earthquakes by area and magnitude
- [NOAA Tides & Water Levels](https://apify.com/pankajbhatia/noaa-tides-currents): tide predictions and water data for U.S. coasts
- [UK Police Crime Data](https://apify.com/pankajbhatia/uk-police-crime-data): UK street-level crimes by postcode
- [UK Food Hygiene Ratings](https://apify.com/pankajbhatia/uk-food-hygiene-ratings): official UK food hygiene ratings
- [FDIC Bank Data](https://apify.com/pankajbhatia/fdic-bank-data): US banks, branches, financials and failures
- [FEMA Disaster Declarations](https://apify.com/pankajbhatia/fema-disaster-declarations): US federal disaster declarations and aid
- [US Hospital & Nursing Home Ratings](https://apify.com/pankajbhatia/us-healthcare-facility-ratings): Medicare Care Compare facility ratings
- [EPA Facility Compliance](https://apify.com/pankajbhatia/epa-facility-compliance): EPA violations, inspections and penalties

# Actor input Schema

## `packages` (type: `array`):

ecosystem:name or ecosystem:name@version, e.g. npm:lodash@4.17.15, PyPI:django@3.2.0, Maven:org.apache.logging.log4j:log4j-core@2.14.1.

## `vulnerabilityIds` (type: `array`):

e.g. CVE-2021-44228, GHSA-jfh8-c2jp-5v3q.

## `kevAddedLastDays` (type: `integer`):

List vulnerabilities CISA added to its Known Exploited catalog in the last N days (0 = off).

## `minSeverity` (type: `string`):

Filter OSV results by severity.

## `onlyKnownExploited` (type: `boolean`):

Only vulnerabilities in the CISA KEV catalog.

## `includeWithdrawn` (type: `boolean`):

Include advisories that were withdrawn.

## `maxResults` (type: `integer`):

Total limit for the run.

## Actor input object example

```json
{
  "packages": [
    "npm:lodash@4.17.15",
    "PyPI:django@3.2.0"
  ],
  "vulnerabilityIds": [],
  "kevAddedLastDays": 0,
  "minSeverity": "any",
  "onlyKnownExploited": false,
  "includeWithdrawn": false,
  "maxResults": 500
}
```

# Actor output Schema

## `results` (type: `string`):

One row per vulnerability with severity, fix versions and exploit status.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "packages": [
        "npm:lodash@4.17.15",
        "PyPI:django@3.2.0"
    ],
    "vulnerabilityIds": [],
    "kevAddedLastDays": 0,
    "maxResults": 500
};

// Run the Actor and wait for it to finish
const run = await client.actor("pankajbhatia/open-source-vulnerability-scanner").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "packages": [
        "npm:lodash@4.17.15",
        "PyPI:django@3.2.0",
    ],
    "vulnerabilityIds": [],
    "kevAddedLastDays": 0,
    "maxResults": 500,
}

# Run the Actor and wait for it to finish
run = client.actor("pankajbhatia/open-source-vulnerability-scanner").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "packages": [
    "npm:lodash@4.17.15",
    "PyPI:django@3.2.0"
  ],
  "vulnerabilityIds": [],
  "kevAddedLastDays": 0,
  "maxResults": 500
}' |
apify call pankajbhatia/open-source-vulnerability-scanner --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,pankajbhatia/open-source-vulnerability-scanner"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/nxIbh88aH9jlDCSgV/builds/PjWkDJwPIbh2XiK5W/openapi.json