Open-Source Vulnerability Checker (OSV.dev): npm, PyPI, Maven, Go & more

Check package@version lists against Google's OSV.dev database across 10 ecosystems. Returns advisory IDs, CVE aliases, severity, fixed-in versions and references. Clean packages flagged too.

Why this actor

• Version-precise matching via OSV (aggregates GitHub Advisories, PyPA, RustSec, Go); clean rows give a full audit trail.
• Pay only for results: $1.00 per 1,000 results, no start fee, failed lookups are free.
• Robust: automatic retries with exponential backoff, respects Retry-After, per-item error rows instead of crashed runs.
• Clean, flat JSON/CSV/Excel output ready for Google Sheets, Make, Zapier, n8n, Clay, or the Apify API.

Use cases

• CI/CD dependency audits without a SaaS subscription
• Security questionnaires and vendor reviews
• Agencies auditing client package.json/requirements.txt
• Daily monitoring of critical dependencies

Input

Field	Type	Description
ecosystem	string	Package ecosystem (OSV naming).
packages	array	name@version (exact vulnerabilities affecting that version) or just name (all known).
includeClean	boolean	Output a row with vulnerable=false for packages with no known issues.
maxItems	integer	0 = no limit. Caps cost.

Example input:

{
  "ecosystem": "npm",
  "packages": [
    "lodash@4.17.15",
    "react@18.3.1"
  ]
}

Output

Each dataset item looks like this (real sample from a test run, long fields trimmed):

{
  "package": "lodash",
  "version": "4.17.15",
  "ecosystem": "npm",
  "vulnerable": true,
  "id": "GHSA-29mw-wpgm-hmr9",
  "aliases": [
    "CVE-2020-28500"
  ],
  "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
  "severity": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "fixedIn": [
    "4.17.21"
  ],
  "published": "2022-01-06T20:30:46Z",
  "modified": "2025-09-29T21:12:31.102523Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2020-28500",
    "https://github.com/github/advisory-database/pull/6139",
    "https://github.com/lodash/lodash/pull/5065",
    "\u2026"
  ],
  "osvUrl": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9",
  "scrapedAt": "2026-10-14T16:21:17+00:00"
}

Rows that could not be processed contain an error field and are not charged.

Pricing

Pay-per-event: $0.001 per result (= $1.00 / 1,000). Use Max results to cap spend. Apify's free plan credit covers thousands of results per month.

Integrations & API

Run on a schedule in Apify Console, call via the Apify API / Python & JS clients, or connect to Make, Zapier, n8n, Google Sheets, Slack and webhooks. Works as a tool for AI agents via Apify MCP.

FAQ

Is this an official tool? No. It is an independent actor and is not affiliated with, sponsored or endorsed by the data source or any trademark owner named here.

Is it legal? The actor only reads publicly available data from public endpoints, without logins, and does not bypass paywalls or access controls. You are responsible for using the data in line with applicable laws (e.g. GDPR) and the source sites' terms.

Something broke? Open an issue in the Issues tab; we typically respond within 24 hours and ship fixes fast.