Package Health Checker: npm & PyPI Security, Licences

AI coding tools are great until they suggest a package that doesn't exist, or one with a known security hole. This checks for that kind of thing before it ends up in your project.

Give it a list of packages or paste in your requirements.txt or package.json. For each one you get the known vulnerabilities for your version, the licence, when it was last updated, whether it's deprecated, and a simple verdict (ok, review or risky) with the reason.

What it does

• Lists known vulnerabilities for the exact version you use, with severity scores
• Spots packages and versions that don't exist (typos, or names an AI made up)
• Flags deprecated packages and copyleft licences, and handles dual licences
• Reads a pasted requirements.txt or package.json
• Sorts licences into permissive, weak copyleft and strong copyleft
• Gives each package an ok / review / risky verdict with the reasons

Use cases

• Checking a project's dependencies for known vulnerabilities before a release.
• Catching made-up or misspelt package names before anyone installs them.
• Spotting GPL or AGPL licences in something you're planning to sell.
• Finding old or deprecated packages that need swapping out.
• Giving an AI agent a quick way to vet packages, through Apify's MCP server.

How to use

1. Put packages in the list (requests==2.31.0, npm:react@18.2.0, cargo:serde) or paste a requirements.txt or package.json into the box.
2. Set the default ecosystem for names without a prefix.
3. Hit Start. Most projects take a few seconds.

You can also call it from the Apify API, run it on a schedule, or hook it up to Make, Zapier or n8n. AI agents can use it through Apify's MCP server.

Input

{
  "packages": [
    "requests==2.25.0",
    "flask",
    "npm:lodash@4.17.15",
    "npm:left-pad"
  ],
  "ecosystem": "pypi"
}

Output

You get one row per result, with these fields: ecosystem, package, requested, checkedVersion, exists, versionExists, latestVersion, latestReleaseDate, daysSinceLatestRelease, deprecated, deprecatedReason, licences, licenceType, vulnerabilityCount, vulnerabilities, weeklyDownloads, sourceRepo, repoStars, openssfScore, verdict, reasons, depsDevUrl, error.

Here's a real result:

{
  "ecosystem": "pypi",
  "package": "requests",
  "requested": "2.25.0",
  "checkedVersion": "2.25.0",
  "exists": true,
  "versionExists": true,
  "latestVersion": "2.34.2",
  "latestReleaseDate": "2026-05-14",
  "daysSinceLatestRelease": 161,
  "deprecated": false,
  "deprecatedReason": null,
  "licences": [
    "Apache-2.0"
  ],
  "licenceType": "permissive",
  "vulnerabilityCount": 8,
  "vulnerabilities": [
    {
      "id": "GHSA-9hjg-9r4m-mvj7",
      "title": "Requests vulnerable to .netrc credentials leak via malicious URLs",
      "cvss3": 5.3,
      "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"
    },
    {
      "id": "GHSA-9wx4-h78v-vm56",
      "title": "Requests `Session` object does not verify requests after making first request with verify=False",
      "cvss3": 5.6,
      "url": "https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56"
    }
  ],
  "weeklyDownloads": 320567487,
  "sourceRepo": "https://github.com/psf/requests",
  "repoStars": 54535,
  "openssfScore": 8.2,
  "verdict": "review",
  "reasons": [
    "8 known vulnerabilities in 2.25.0 (worst CVSS 6.1)"
  ],
  "depsDevUrl": "https://deps.dev/pypi/requests",
  "error": null
}

Pricing

$0.002 per package checked. You only pay for results that work. Anything that fails comes back with an error and is free. You can set a max spend per run in the run options.

So 100 packages cost about $0.20, and 1,000 about $2.00.

FAQ

Where's the data from?

Google's Open Source Insights (deps.dev), which pulls together the package registries, the OSV vulnerability database and OpenSSF Scorecards. Download counts come from npm and PyPI.

What do the verdicts mean?

risky: deprecated, or a vulnerability rated 7 or higher. review: smaller vulnerabilities, a version that doesn't exist, nothing released in 2 years, or a licence worth a look. ok: nothing found.

What about ranges like ^1.2.0?

Ranges get checked against the latest version, and it tells you that's what it did. Pin an exact version if you want that one checked.

Do I pay for a package that doesn't exist?

Yes, because finding that out is the point. Duplicates and invalid input are free.

Limitations

• It's only as good as the public vulnerability databases. 'No known issues' doesn't mean it's definitely safe.
• The licence types are a guide, so check anything important properly.
• Download counts are only for npm and PyPI.

Other tools you might like

• Security Headers Checker: grade a list of websites on their security headers, A to F.
• Website Tech Stack Detector: what a website is built with: CMS, frameworks, analytics, hosting.
• UK & EU Public Tenders Finder: new government contracts that match your keywords.

Support

This Actor is built and maintained by an automated system run by its publisher. If something's wrong, open an issue and it'll be looked at within 7 days. Please don't put passwords or personal details in an issue.