# Package Vulnerability Scanner (OSV SCA, CVSS + Fixes) (`scrapers_lat/package-vulnerability-scanner`) Actor

Scan open-source packages for known vulnerabilities from OSV.dev (GHSA, CVE, PYSEC, RUSTSEC, GO). Query by name+ecosystem, exact version or git commit. Parsed CVSS score + severity, affected and fixed version ranges, CWEs and CVE aliases. Batch and version-specific.

- **URL**: https://apify.com/scrapers\_lat/package-vulnerability-scanner.md
- **Developed by:** [Scrapers Lat](https://apify.com/scrapers_lat) (community)
- **Categories:** Developer tools, Other
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $8.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

[![Package Vulnerability Scanner (OSV SCA, CVSS + Fixes)](https://scrapers.lat/banners/package-vulnerability-scanner.png)](https://console.apify.com/actors/dgXMs4aer7Mz6lb79/input)

## Package Vulnerability Scanner (OSV SCA, CVSS + Fixes)

Here is one real result, with every field the actor returns:

```json
{
  "packageName": "lodash",
  "ecosystem": "npm",
  "queriedVersion": null,
  "vulnId": "GHSA-29mw-wpgm-hmr9",
  "aliases": ["CVE-2020-28500"],
  "cveIds": ["CVE-2020-28500"],
  "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
  "detailsShort": "All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `toNumber`, `trim` and `trimEnd` functions.",
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "cvssBaseScore": 5.3,
  "severityLabel": "Medium",
  "cwes": ["CWE-1333", "CWE-400"],
  "introducedVersion": "4.0.0",
  "fixedVersion": "4.17.21",
  "isFixed": true,
  "affectedRanges": "SEMVER: >=4.0.0 <4.17.21",
  "referencesUrls": [
    "https://nvd.nist.gov/vuln/detail/CVE-2020-28500",
    "https://github.com/lodash/lodash/pull/5065",
    "https://snyk.io/vuln/SNYK-JS-LODASH-1018905"
  ],
  "advisoryUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-28500",
  "published": "2022-01-06T20:30:46Z",
  "modified": "2025-09-29T21:12:31.102523Z",
  "githubReviewed": true,
  "observedAt": "2026-08-16T13:20:57.979Z",
  "error": null
}
```

The most complete open-source dependency vulnerability scanner available. It returns every vulnerability OSV.dev knows for a package (aggregating GHSA, CVE, PYSEC, RUSTSEC, GO and more), plus derived fields most tools skip: a numeric CVSS base score computed from the vector, a clear severity label, the exact introduced and fixed version ranges, and CVE aliases split out. Query by package name, by exact version, in batch, or by git commit.

**📥 [Input](https://apify.com/scrapers_lat/package-vulnerability-scanner/input-schema) · 📤 [Output](https://apify.com/scrapers_lat/package-vulnerability-scanner/output-schema) · 💰 [Pricing](https://apify.com/scrapers_lat/package-vulnerability-scanner/pricing) · ▶️ [Examples](https://apify.com/scrapers_lat/package-vulnerability-scanner/examples)**

![Apify](https://img.shields.io/badge/Platform-Apify-1CE1CE?logo=apify\&logoColor=white)
![Coverage](https://img.shields.io/badge/Coverage-20%2B%20ecosystems-blue)
![Output](https://img.shields.io/badge/Output-JSON%20%7C%20CSV%20%7C%20Excel-orange)
![Billing](https://img.shields.io/badge/Billing-Pay%20per%20result-brightgreen)

### Table of contents

- [What it does](#what-it-does)
- [Use cases](#use-cases)
- [Quickstart](#quickstart)
- [Input reference](#input-reference)
- [Output reference](#output-reference)
- [Example output record](#example-output-record)
- [Run via API and CLI](#run-via-api-and-cli)
- [Fetch results](#fetch-results)
- [Billing and limits](#billing-and-limits)
- [FAQ and troubleshooting](#faq-and-troubleshooting)
- [Related scrapers](#related-scrapers)

### What it does

Give it one or many open-source packages and it returns every known security vulnerability affecting them, sourced from the OSV.dev database. OSV aggregates advisories from GitHub Security Advisories (GHSA), the National Vulnerability Database (CVE), PyPA (PYSEC), RustSec, the Go vulnerability database, and Linux distribution feeds.

For software composition analysis (SCA), dependency risk review, SBOM enrichment, and security due-diligence, it goes further than a raw advisory feed:

- Computes a numeric CVSS 3.x base score from the official vector, so you can sort and threshold by severity.
- Adds a plain severity label (Critical, High, Medium, Low) derived from the score, or from the advisory database when no CVSS vector is present.
- Extracts the introduced and first fixed versions, plus a compact affected-range string, so you know exactly what to upgrade to.
- Splits CVE aliases out of the alias list and lists CWE weakness IDs.
- Supports version-specific queries (only vulnerabilities affecting that exact version), git commit queries, and efficient batch scanning across many packages.

Three query modes, combinable in one run:

1. A single package with name plus ecosystem (and optional version).
2. A `packages[]` array for batch scanning.
3. A git commit SHA.

### Use cases

Common ways teams use this open-source vulnerability scanner and dependency risk API:

- Software composition analysis (SCA): scan every dependency in a `package.json`, `requirements.txt`, `go.mod`, `Cargo.toml`, `pom.xml` or `.csproj` lockfile for known CVEs.
- CI/CD security gate: fail a build when a dependency has a Critical or High CVSS vulnerability by setting `minCvss`.
- SBOM enrichment: turn a bare software bill of materials into a risk-scored list with CVSS scores, fixed versions and license data.
- Supply-chain risk review: with the deps.dev add-on, check whether a package is healthy, well-maintained and widely used via its OpenSSF Scorecard score and dependents count before adopting it.
- Vendor and open-source due diligence: audit a third-party library for security debt, unfixed vulnerabilities and abandonment risk.
- Upgrade planning: build an actionable "what to upgrade to" list with exact fixed versions, and get plain-English remediation advice from the AI add-on.
- Continuous dependency monitoring: re-scan pinned versions on a schedule to catch newly disclosed CVEs affecting what you already ship.
- License compliance checks: pull declared license(s) per package alongside its vulnerabilities with the deps.dev add-on.

### Quickstart

Scan two packages, one of them pinned to an exact version:

```json
{
  "packages": [
    { "name": "lodash", "ecosystem": "npm" },
    { "name": "django", "ecosystem": "PyPI", "version": "3.2.0" }
  ],
  "maxResults": 1000
}
```

Or the single-package convenience form:

```json
{
  "packageName": "org.apache.logging.log4j:log4j-core",
  "ecosystem": "Maven",
  "version": "2.14.1"
}
```

OSV package names are case-sensitive: npm names are lowercase, PyPI and crates.io names are exact, and Maven packages use the full `groupId:artifactId` form (for example `org.apache.logging.log4j:log4j-core`).

### Input reference

| Name | Type | Required | Description | Example |
| --- | --- | --- | --- | --- |
| `packages` | array | one of these three | List of `{name, ecosystem, version?, commit?}` objects to scan in batch. | `[{"name":"lodash","ecosystem":"npm"}]` |
| `packageName` | string | one of these three | Single package name. Pair with `ecosystem`. | `"django"` |
| `ecosystem` | string | with `packageName` | Ecosystem of the single package. | `"PyPI"` |
| `version` | string | no | Exact version for the single package; returns only vulnerabilities affecting it. | `"3.2.0"` |
| `commit` | string | one of these three | Git commit SHA to scan. | `"6879efc2..."` |
| `onlyFixed` | boolean | no | Only include vulnerabilities that have a known fixed version. | `true` |
| `minCvss` | integer | no | Only include vulnerabilities with a computed CVSS 3.x base score at or above this value (0 to 10). | `9` |
| `oneRowPerPackage` | boolean | no | Return one row per package with a nested `vulns[]` array instead of one row per vulnerability. | `false` |
| `maxVulnsPerPackage` | integer | no | Cap vulnerabilities kept per package (highest CVSS first). | `5` |
| `withDepsDev` | boolean | no | Paid add-on. Add deps.dev supply-chain context (OpenSSF Scorecard, dependents, license, latest version, links). Billed $0.012 per package on success. Off for free users. | `true` |
| `withAiSummary` | boolean | no | Paid AI add-on. Add plain-English remediation advice per vulnerable package. Billed $0.012 per package on usable output. Off for free users. | `true` |
| `maxResults` | integer | no | Maximum output rows to collect. Free plans are capped at 10. | `1000` |
| `proxyConfiguration` | object | no | Optional Apify proxy. The OSV API is open and needs no proxy. | `{"useApifyProxy": false}` |

Supported ecosystems include npm, PyPI, Go, Maven, RubyGems, crates.io, NuGet, Packagist, Pub, Hex, Composer, Debian, Alpine, Ubuntu, GitHub Actions, Swift, and more.

### Output reference

Default mode returns one row per vulnerability per package.

| Name | Type | Description |
| --- | --- | --- |
| `packageName` | string | Package name as queried. |
| `ecosystem` | string | Ecosystem (npm, PyPI, Maven, ...). |
| `queriedVersion` | string | Version queried, or null if none. |
| `vulnId` | string | OSV / advisory ID (for example GHSA-29mw-wpgm-hmr9). |
| `aliases` | array | All alias IDs (CVE, GHSA, PYSEC, ...). |
| `cveIds` | array | CVE aliases only. |
| `summary` | string | Short vulnerability summary. |
| `detailsShort` | string | Details text truncated to about 500 characters. |
| `cvssVector` | string | CVSS vector string from the advisory. |
| `cvssBaseScore` | number | CVSS 3.x base score (0 to 10) computed from the vector. |
| `severityLabel` | string | Critical, High, Medium, Low, or None. |
| `cwes` | array | CWE weakness IDs. |
| `introducedVersion` | string | Version the vulnerability was introduced. |
| `fixedVersion` | string | First fixed version, or null if unfixed. |
| `isFixed` | boolean | Whether a fix is available. |
| `affectedRanges` | string | Compact affected version-range string. |
| `referencesUrls` | array | Reference URLs. |
| `advisoryUrl` | string | Primary advisory URL. |
| `published` | string | Published date. |
| `modified` | string | Last modified date. |
| `githubReviewed` | boolean | Whether GitHub reviewed the advisory. |
| `observedAt` | string | Scan timestamp. |
| `error` | string | Error message if the lookup failed, else null. |

With the `withDepsDev` add-on enabled, each row also carries `depsDevSystem`, `latestVersion`, `licenses`, `scorecardScore` (OpenSSF Scorecard 0 to 10), `scorecardProject`, `projectStars`, `projectOpenIssues`, `dependentsCount`, `depsDevLinks` and `depsDevUrl`. With the `withAiSummary` add-on enabled, each row carries `aiRemediation` (a plain-English upgrade recommendation). These fields are null when the add-on is off.

With `oneRowPerPackage: true`, each row instead carries `vulnCount`, `maxCvss`, `hasCriticalVuln`, `commit`, and a nested `vulns[]` array of the records above.

### Example output record

A real Critical finding for `org.apache.logging.log4j:log4j-core` version 2.14.1 (Log4Shell):

```json
{
  "packageName": "org.apache.logging.log4j:log4j-core",
  "ecosystem": "Maven",
  "queriedVersion": "2.14.1",
  "vulnId": "GHSA-jfh8-c2jp-5v3q",
  "aliases": ["CVE-2021-44228"],
  "cveIds": ["CVE-2021-44228"],
  "summary": "Remote code injection in Log4j",
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "cvssBaseScore": 10,
  "severityLabel": "Critical",
  "cwes": ["CWE-20", "CWE-400", "CWE-502"],
  "introducedVersion": "2.0",
  "fixedVersion": "2.15.0",
  "isFixed": true,
  "affectedRanges": "ECOSYSTEM: >=2.0 <2.15.0",
  "advisoryUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
  "published": "2021-12-10T00:20:56Z",
  "githubReviewed": true,
  "observedAt": "2026-08-16T13:23:00.000Z",
  "error": null
}
```

### Run via API and CLI

Start a run with the Apify API:

```bash
curl -X POST "https://api.apify.com/v2/acts/scrapers_lat~package-vulnerability-scanner/runs?token=$APIFY_TOKEN" \
  -H "content-type: application/json" \
  -d '{"packages":[{"name":"lodash","ecosystem":"npm"}],"minCvss":7}'
```

Or with the Apify CLI:

```bash
apify call scrapers_lat/package-vulnerability-scanner \
  --input='{"packageName":"django","ecosystem":"PyPI","version":"3.2.0"}'
```

### Fetch results

Read the dataset items once the run finishes:

```bash
curl "https://api.apify.com/v2/datasets/<datasetId>/items?token=$APIFY_TOKEN&format=json"
```

Add `&format=csv` or `&format=xlsx` for spreadsheet output.

### Billing and limits

- Pay per result. You are charged for each vulnerability row (the `result` event) at the price shown on the actor's pricing tab.
- Packages with no known vulnerabilities are not charged. A clean package still emits one informational row so you can see it was checked, but that row is not billable.
- No charge on failure. If a lookup errors, the error row is surfaced without silently dropping data.
- Optional deps.dev add-on (`deps_dev`, $0.012 per package). Enable `withDepsDev` to add OpenSSF Scorecard, dependents count, license(s), latest version and project links. Charged once per package, only when deps.dev returns data. Disabled for free users.
- Optional AI remediation add-on (`ai_summary`, $0.012 per package). Enable `withAiSummary` for a plain-English upgrade recommendation per vulnerable package. Charged once per package, only when usable AI output is produced. Disabled for free users.
- Both add-ons default to off. You only pay for them when you turn them on and they genuinely return data.
- Free Apify plans are capped at 10 result rows per run and cannot use the paid add-ons. Paid plans lift the cap; set `maxResults` to control volume.
- A spend guard stops emitting billable rows and charging add-ons once your configured maximum charge is reached.

### FAQ and troubleshooting

**I searched a package and got zero vulnerabilities. Is it broken?** No. It means OSV has no known advisories for that package (or that exact version). Check the informational row: `vulnCount` is 0 and `error` is null.

**Why is `cvssBaseScore` sometimes null but `severityLabel` is set?** Some advisories provide only a CVSS v4 vector or no vector at all. The base score is computed for CVSS 3.x vectors; when none is present the severity label falls back to the advisory database rating. No score is ever fabricated.

**How do I query a Maven package?** Use the full `groupId:artifactId`, for example `org.apache.logging.log4j:log4j-core`, with ecosystem `Maven`.

**Can I scan a whole lockfile?** Parse your lockfile into a `packages[]` array of `{name, ecosystem, version}` and pass it in one run. Batch scans run concurrently.

**Does a version filter matter?** Yes. Passing `version` returns only vulnerabilities that actually affect that version, which is what you want for an installed dependency. Omit it to see the full history for the package.

### Related scrapers

- CISA KEV Known Exploited Vulnerabilities Scraper: CVEs actively exploited in the wild, with EPSS enrichment.
- NVD CVE Scraper: the full National Vulnerability Database with rich filters.
- Token Security Risk Scraper: on-chain token risk and honeypot signals.

More scrapers at [scrapers.lat](https://scrapers.lat).

# Actor input Schema

## `packages` (type: `array`):

List of packages to scan. Each item is an object like {"name": "lodash", "ecosystem": "npm"} and may include "version" (to return only vulns affecting that version) or "commit" (git SHA). OSV is case-sensitive: npm names are lowercase, PyPI and crates.io exact.

## `packageName` (type: `string`):

Convenience single-package name, for example lodash, django or log4j-core. Use together with Ecosystem (and optionally Version).

## `ecosystem` (type: `string`):

Ecosystem for the single package. Common values: npm, PyPI, Go, Maven, RubyGems, crates.io, NuGet, Packagist, Pub, Hex, Debian, Alpine.

## `version` (type: `string`):

Optional exact version for the single package, for example 3.2.0. When set, only vulnerabilities affecting that version are returned.

## `commit` (type: `string`):

Optional git commit SHA to scan (OSV returns vulnerabilities whose affected range includes this commit).

## `onlyFixed` (type: `boolean`):

Only include vulnerabilities that have a known fixed version. Useful to build an actionable upgrade list.

## `minCvss` (type: `integer`):

Only include vulnerabilities with a computed CVSS 3.x base score at or above this value (0 to 10). Vulnerabilities without a CVSS v3 vector are excluded when this is set.

## `oneRowPerPackage` (type: `boolean`):

Return one row per package with a nested vulns\[] array plus vulnCount, maxCvss and hasCriticalVuln, instead of one row per vulnerability.

## `maxVulnsPerPackage` (type: `integer`):

Cap the number of vulnerabilities kept per package (highest CVSS first). Leave empty for all.

## `withDepsDev` (type: `boolean`):

Optional paid add-on. For each package, makes an extra call to Google's deps.dev to add supply-chain risk context the vuln scan lacks: OpenSSF Scorecard score, dependents count, license(s), latest version, repo stars and project links. Billed $0.012 per package, only when deps.dev returns data. Disabled for free Apify users.

## `withAiSummary` (type: `boolean`):

Optional paid AI add-on. Uses AI to write one concise plain-English remediation paragraph per vulnerable package: overall risk, which version to upgrade to, and a breaking-change caution. Billed $0.012 per package, only when usable AI output is produced. Disabled for free Apify users.

## `maxResults` (type: `integer`):

Maximum number of output rows to collect. Free Apify plans are capped at 10 per run.

## `proxyConfiguration` (type: `object`):

Optional. The OSV.dev API is open and needs no proxy, but you can route requests through an Apify proxy if you prefer.

## Actor input object example

```json
{
  "onlyFixed": false,
  "oneRowPerPackage": false,
  "withDepsDev": false,
  "withAiSummary": false,
  "maxResults": 1000,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "maxResults": 1000
};

// Run the Actor and wait for it to finish
const run = await client.actor("scrapers_lat/package-vulnerability-scanner").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "maxResults": 1000 }

# Run the Actor and wait for it to finish
run = client.actor("scrapers_lat/package-vulnerability-scanner").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "maxResults": 1000
}' |
apify call scrapers_lat/package-vulnerability-scanner --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,scrapers_lat/package-vulnerability-scanner"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/dgXMs4aer7Mz6lb79/builds/ub0JQYr8hOSDdTqTG/openapi.json