Package Vulnerability Scanner (OSV SCA, CVSS + Fixes)

Here is one real result, with every field the actor returns:

{
  "packageName": "lodash",
  "ecosystem": "npm",
  "queriedVersion": null,
  "vulnId": "GHSA-29mw-wpgm-hmr9",
  "aliases": ["CVE-2020-28500"],
  "cveIds": ["CVE-2020-28500"],
  "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
  "detailsShort": "All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `toNumber`, `trim` and `trimEnd` functions.",
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "cvssBaseScore": 5.3,
  "severityLabel": "Medium",
  "cwes": ["CWE-1333", "CWE-400"],
  "introducedVersion": "4.0.0",
  "fixedVersion": "4.17.21",
  "isFixed": true,
  "affectedRanges": "SEMVER: >=4.0.0 <4.17.21",
  "referencesUrls": [
    "https://nvd.nist.gov/vuln/detail/CVE-2020-28500",
    "https://github.com/lodash/lodash/pull/5065",
    "https://snyk.io/vuln/SNYK-JS-LODASH-1018905"
  ],
  "advisoryUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-28500",
  "published": "2022-01-06T20:30:46Z",
  "modified": "2025-09-29T21:12:31.102523Z",
  "githubReviewed": true,
  "observedAt": "2026-08-16T13:20:57.979Z",
  "error": null
}

The most complete open-source dependency vulnerability scanner available. It returns every vulnerability OSV.dev knows for a package (aggregating GHSA, CVE, PYSEC, RUSTSEC, GO and more), plus derived fields most tools skip: a numeric CVSS base score computed from the vector, a clear severity label, the exact introduced and fixed version ranges, and CVE aliases split out. Query by package name, by exact version, in batch, or by git commit.

📥 Input · 📤 Output · 💰 Pricing · ▶️ Examples

Table of contents

• What it does
• Use cases
• Quickstart
• Input reference
• Output reference
• Example output record
• Run via API and CLI
• Fetch results
• Billing and limits
• FAQ and troubleshooting
• Related scrapers

What it does

Give it one or many open-source packages and it returns every known security vulnerability affecting them, sourced from the OSV.dev database. OSV aggregates advisories from GitHub Security Advisories (GHSA), the National Vulnerability Database (CVE), PyPA (PYSEC), RustSec, the Go vulnerability database, and Linux distribution feeds.

For software composition analysis (SCA), dependency risk review, SBOM enrichment, and security due-diligence, it goes further than a raw advisory feed:

• Computes a numeric CVSS 3.x base score from the official vector, so you can sort and threshold by severity.
• Adds a plain severity label (Critical, High, Medium, Low) derived from the score, or from the advisory database when no CVSS vector is present.
• Extracts the introduced and first fixed versions, plus a compact affected-range string, so you know exactly what to upgrade to.
• Splits CVE aliases out of the alias list and lists CWE weakness IDs.
• Supports version-specific queries (only vulnerabilities affecting that exact version), git commit queries, and efficient batch scanning across many packages.

Three query modes, combinable in one run:

1. A single package with name plus ecosystem (and optional version).
2. A packages[] array for batch scanning.
3. A git commit SHA.

Use cases

Common ways teams use this open-source vulnerability scanner and dependency risk API:

• Software composition analysis (SCA): scan every dependency in a package.json, requirements.txt, go.mod, Cargo.toml, pom.xml or .csproj lockfile for known CVEs.
• CI/CD security gate: fail a build when a dependency has a Critical or High CVSS vulnerability by setting minCvss.
• SBOM enrichment: turn a bare software bill of materials into a risk-scored list with CVSS scores, fixed versions and license data.
• Supply-chain risk review: with the deps.dev add-on, check whether a package is healthy, well-maintained and widely used via its OpenSSF Scorecard score and dependents count before adopting it.
• Vendor and open-source due diligence: audit a third-party library for security debt, unfixed vulnerabilities and abandonment risk.
• Upgrade planning: build an actionable "what to upgrade to" list with exact fixed versions, and get plain-English remediation advice from the AI add-on.
• Continuous dependency monitoring: re-scan pinned versions on a schedule to catch newly disclosed CVEs affecting what you already ship.
• License compliance checks: pull declared license(s) per package alongside its vulnerabilities with the deps.dev add-on.

Quickstart

Scan two packages, one of them pinned to an exact version:

{
  "packages": [
    { "name": "lodash", "ecosystem": "npm" },
    { "name": "django", "ecosystem": "PyPI", "version": "3.2.0" }
  ],
  "maxResults": 1000
}

Or the single-package convenience form:

{
  "packageName": "org.apache.logging.log4j:log4j-core",
  "ecosystem": "Maven",
  "version": "2.14.1"
}

OSV package names are case-sensitive: npm names are lowercase, PyPI and crates.io names are exact, and Maven packages use the full groupId:artifactId form (for example org.apache.logging.log4j:log4j-core).

Input reference

Name	Type	Required	Description	Example
packages	array	one of these three	List of {name, ecosystem, version?, commit?} objects to scan in batch.	[{"name":"lodash","ecosystem":"npm"}]
packageName	string	one of these three	Single package name. Pair with ecosystem.	"django"
ecosystem	string	with packageName	Ecosystem of the single package.	"PyPI"
version	string	no	Exact version for the single package; returns only vulnerabilities affecting it.	"3.2.0"
commit	string	one of these three	Git commit SHA to scan.	"6879efc2..."
onlyFixed	boolean	no	Only include vulnerabilities that have a known fixed version.	true
minCvss	integer	no	Only include vulnerabilities with a computed CVSS 3.x base score at or above this value (0 to 10).	9
oneRowPerPackage	boolean	no	Return one row per package with a nested vulns[] array instead of one row per vulnerability.	false
maxVulnsPerPackage	integer	no	Cap vulnerabilities kept per package (highest CVSS first).	5
withDepsDev	boolean	no	Paid add-on. Add deps.dev supply-chain context (OpenSSF Scorecard, dependents, license, latest version, links). Billed $0.012 per package on success. Off for free users.	true
withAiSummary	boolean	no	Paid AI add-on. Add plain-English remediation advice per vulnerable package. Billed $0.012 per package on usable output. Off for free users.	true
maxResults	integer	no	Maximum output rows to collect. Free plans are capped at 10.	1000
proxyConfiguration	object	no	Optional Apify proxy. The OSV API is open and needs no proxy.	{"useApifyProxy": false}

Supported ecosystems include npm, PyPI, Go, Maven, RubyGems, crates.io, NuGet, Packagist, Pub, Hex, Composer, Debian, Alpine, Ubuntu, GitHub Actions, Swift, and more.

Output reference

Default mode returns one row per vulnerability per package.

Name	Type	Description
packageName	string	Package name as queried.
ecosystem	string	Ecosystem (npm, PyPI, Maven, ...).
queriedVersion	string	Version queried, or null if none.
vulnId	string	OSV / advisory ID (for example GHSA-29mw-wpgm-hmr9).
aliases	array	All alias IDs (CVE, GHSA, PYSEC, ...).
cveIds	array	CVE aliases only.
summary	string	Short vulnerability summary.
detailsShort	string	Details text truncated to about 500 characters.
cvssVector	string	CVSS vector string from the advisory.
cvssBaseScore	number	CVSS 3.x base score (0 to 10) computed from the vector.
severityLabel	string	Critical, High, Medium, Low, or None.
cwes	array	CWE weakness IDs.
introducedVersion	string	Version the vulnerability was introduced.
fixedVersion	string	First fixed version, or null if unfixed.
isFixed	boolean	Whether a fix is available.
affectedRanges	string	Compact affected version-range string.
referencesUrls	array	Reference URLs.
advisoryUrl	string	Primary advisory URL.
published	string	Published date.
modified	string	Last modified date.
githubReviewed	boolean	Whether GitHub reviewed the advisory.
observedAt	string	Scan timestamp.
error	string	Error message if the lookup failed, else null.

With the withDepsDev add-on enabled, each row also carries depsDevSystem, latestVersion, licenses, scorecardScore (OpenSSF Scorecard 0 to 10), scorecardProject, projectStars, projectOpenIssues, dependentsCount, depsDevLinks and depsDevUrl. With the withAiSummary add-on enabled, each row carries aiRemediation (a plain-English upgrade recommendation). These fields are null when the add-on is off.

With oneRowPerPackage: true, each row instead carries vulnCount, maxCvss, hasCriticalVuln, commit, and a nested vulns[] array of the records above.

Example output record

A real Critical finding for org.apache.logging.log4j:log4j-core version 2.14.1 (Log4Shell):

{
  "packageName": "org.apache.logging.log4j:log4j-core",
  "ecosystem": "Maven",
  "queriedVersion": "2.14.1",
  "vulnId": "GHSA-jfh8-c2jp-5v3q",
  "aliases": ["CVE-2021-44228"],
  "cveIds": ["CVE-2021-44228"],
  "summary": "Remote code injection in Log4j",
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "cvssBaseScore": 10,
  "severityLabel": "Critical",
  "cwes": ["CWE-20", "CWE-400", "CWE-502"],
  "introducedVersion": "2.0",
  "fixedVersion": "2.15.0",
  "isFixed": true,
  "affectedRanges": "ECOSYSTEM: >=2.0 <2.15.0",
  "advisoryUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
  "published": "2021-12-10T00:20:56Z",
  "githubReviewed": true,
  "observedAt": "2026-08-16T13:23:00.000Z",
  "error": null
}

Run via API and CLI

Start a run with the Apify API:

curl -X POST "https://api.apify.com/v2/acts/scrapers_lat~package-vulnerability-scanner/runs?token=$APIFY_TOKEN" \
  -H "content-type: application/json" \
  -d '{"packages":[{"name":"lodash","ecosystem":"npm"}],"minCvss":7}'

Or with the Apify CLI:

apify call scrapers_lat/package-vulnerability-scanner \
  --input='{"packageName":"django","ecosystem":"PyPI","version":"3.2.0"}'

Fetch results

Read the dataset items once the run finishes:

$curl "https://api.apify.com/v2/datasets/<datasetId>/items?token=$APIFY_TOKEN&format=json"

Add &format=csv or &format=xlsx for spreadsheet output.

Billing and limits

• Pay per result. You are charged for each vulnerability row (the result event) at the price shown on the actor's pricing tab.
• Packages with no known vulnerabilities are not charged. A clean package still emits one informational row so you can see it was checked, but that row is not billable.
• No charge on failure. If a lookup errors, the error row is surfaced without silently dropping data.
• Optional deps.dev add-on (deps_dev, $0.012 per package). Enable withDepsDev to add OpenSSF Scorecard, dependents count, license(s), latest version and project links. Charged once per package, only when deps.dev returns data. Disabled for free users.
• Optional AI remediation add-on (ai_summary, $0.012 per package). Enable withAiSummary for a plain-English upgrade recommendation per vulnerable package. Charged once per package, only when usable AI output is produced. Disabled for free users.
• Both add-ons default to off. You only pay for them when you turn them on and they genuinely return data.
• Free Apify plans are capped at 10 result rows per run and cannot use the paid add-ons. Paid plans lift the cap; set maxResults to control volume.
• A spend guard stops emitting billable rows and charging add-ons once your configured maximum charge is reached.

FAQ and troubleshooting

I searched a package and got zero vulnerabilities. Is it broken? No. It means OSV has no known advisories for that package (or that exact version). Check the informational row: vulnCount is 0 and error is null.

Why is cvssBaseScore sometimes null but severityLabel is set? Some advisories provide only a CVSS v4 vector or no vector at all. The base score is computed for CVSS 3.x vectors; when none is present the severity label falls back to the advisory database rating. No score is ever fabricated.

How do I query a Maven package? Use the full groupId:artifactId, for example org.apache.logging.log4j:log4j-core, with ecosystem Maven.

Can I scan a whole lockfile? Parse your lockfile into a packages[] array of {name, ecosystem, version} and pass it in one run. Batch scans run concurrently.

Does a version filter matter? Yes. Passing version returns only vulnerabilities that actually affect that version, which is what you want for an installed dependency. Omit it to see the full history for the package.

Related scrapers

• CISA KEV Known Exploited Vulnerabilities Scraper: CVEs actively exploited in the wild, with EPSS enrichment.
• NVD CVE Scraper: the full National Vulnerability Database with rich filters.
• Token Security Risk Scraper: on-chain token risk and honeypot signals.

More scrapers at scrapers.lat.