Package Trust Check (npm, PyPI, Cargo, Maven, Go, NuGet)
Pricing
from $3.00 / 1,000 results
Package Trust Check (npm, PyPI, Cargo, Maven, Go, NuGet)
Should your code or AI agent install this package? Give ecosystem:name[@version], get license, known advisories, deprecation, latest version, OpenSSF Scorecard and a simple verdict (ok / caution / avoid). Data from deps.dev and OSV, no API key.
Pricing
from $3.00 / 1,000 results
Rating
0.0
(0)
Developer
Sasha Secrier
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
2 days ago
Last modified
Categories
Share
Before your code or AI agent installs a dependency, ask: is it safe to use? Give ecosystem:name (optionally @version) and get one clean row: license, known security advisories for that exact version, deprecation, whether it is the latest version, OpenSSF Scorecard, and a simple verdict. No API key.
Output
Also included: publishedAt, ageDays, deprecated, advisories (id, title, CVSS, CVE aliases, link), sourceRepo, stars.
Verdict rule (deterministic)
avoid: version is deprecated, or has a known advisory with CVSS >= 7.0.caution: any other advisory, no declared license, OpenSSF Scorecard below 4/10, or not the latest version.ok: none of the above.unknown: package or version not found, or the data source failed (reason inerror).
A verdict is a quick screen, not a security audit. Advisories only cover what is published in public databases.
Input
| Field | Meaning |
|---|---|
packages | One per entry: npm:lodash@4.17.20, pypi:requests, npm:@angular/core, maven:group:artifact@version. Up to 100 per run. |
Ecosystems: npm, pypi, cargo, maven, go, nuget. No version means the latest.
Good for
- AI coding agents that pick or add dependencies and need a yes/no with reasons.
- CI checks and audits of a list of dependencies.
- Comparing candidate libraries by license, maintenance and known issues.
Data sources
deps.dev (Google Open Source Insights; data CC-BY 4.0), advisories from OSV, and OpenSSF Scorecard. This Actor is independent and not affiliated with these projects.
Pricing
Pay per result (one row = one package). See the pricing box on this page.
