# Package Health Checker: npm & PyPI Security, Licences (`somepineapple/package-health-checker`) Actor

Check npm, PyPI and other packages before you trust them. Shows known vulnerabilities for your version, the licence, whether it's deprecated or abandoned, and whether it even exists. Paste a requirements.txt or package.json and every package gets an ok, review or risky.

- **URL**: https://apify.com/somepineapple/package-health-checker.md
- **Developed by:** [Ollie Wood](https://apify.com/somepineapple) (community)
- **Categories:** Developer tools, Open source, AI
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$2.00 / 1,000 package checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Package Health Checker: npm & PyPI Security, Licences

AI coding tools are great until they suggest a package that doesn't exist, or one with a known security hole. This checks for that kind of thing before it ends up in your project.

Give it a list of packages or paste in your requirements.txt or package.json. For each one you get the known vulnerabilities for your version, the licence, when it was last updated, whether it's deprecated, and a simple verdict (ok, review or risky) with the reason.

### What it does

- Lists known vulnerabilities for the exact version you use, with severity scores
- Spots packages and versions that don't exist (typos, or names an AI made up)
- Flags deprecated packages and copyleft licences, and handles dual licences
- Reads a pasted requirements.txt or package.json
- Sorts licences into permissive, weak copyleft and strong copyleft
- Gives each package an ok / review / risky verdict with the reasons

### Use cases

- Checking a project's dependencies for known vulnerabilities before a release.
- Catching made-up or misspelt package names before anyone installs them.
- Spotting GPL or AGPL licences in something you're planning to sell.
- Finding old or deprecated packages that need swapping out.
- Giving an AI agent a quick way to vet packages, through Apify's MCP server.

### How to use

1. Put packages in the list (requests==2.31.0, npm:react@18.2.0, cargo:serde) or paste a requirements.txt or package.json into the box.
2. Set the default ecosystem for names without a prefix.
3. Hit Start. Most projects take a few seconds.

You can also call it from the Apify API, run it on a schedule, or hook it up to Make, Zapier or n8n. AI agents can use it through Apify's MCP server.

### Input

```json
{
  "packages": [
    "requests==2.25.0",
    "flask",
    "npm:lodash@4.17.15",
    "npm:left-pad"
  ],
  "ecosystem": "pypi"
}
```

### Output

You get one row per result, with these fields: `ecosystem`, `package`, `requested`, `checkedVersion`, `exists`, `versionExists`, `latestVersion`, `latestReleaseDate`, `daysSinceLatestRelease`, `deprecated`, `deprecatedReason`, `licences`, `licenceType`, `vulnerabilityCount`, `vulnerabilities`, `weeklyDownloads`, `sourceRepo`, `repoStars`, `openssfScore`, `verdict`, `reasons`, `depsDevUrl`, `error`.

Here's a real result:

```json
{
  "ecosystem": "pypi",
  "package": "requests",
  "requested": "2.25.0",
  "checkedVersion": "2.25.0",
  "exists": true,
  "versionExists": true,
  "latestVersion": "2.34.2",
  "latestReleaseDate": "2026-05-14",
  "daysSinceLatestRelease": 161,
  "deprecated": false,
  "deprecatedReason": null,
  "licences": [
    "Apache-2.0"
  ],
  "licenceType": "permissive",
  "vulnerabilityCount": 8,
  "vulnerabilities": [
    {
      "id": "GHSA-9hjg-9r4m-mvj7",
      "title": "Requests vulnerable to .netrc credentials leak via malicious URLs",
      "cvss3": 5.3,
      "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"
    },
    {
      "id": "GHSA-9wx4-h78v-vm56",
      "title": "Requests `Session` object does not verify requests after making first request with verify=False",
      "cvss3": 5.6,
      "url": "https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56"
    }
  ],
  "weeklyDownloads": 320567487,
  "sourceRepo": "https://github.com/psf/requests",
  "repoStars": 54535,
  "openssfScore": 8.2,
  "verdict": "review",
  "reasons": [
    "8 known vulnerabilities in 2.25.0 (worst CVSS 6.1)"
  ],
  "depsDevUrl": "https://deps.dev/pypi/requests",
  "error": null
}
```

### Pricing

**$0.002 per package checked.** You only pay for results that work. Anything that fails comes back with an `error` and is free. You can set a max spend per run in the run options.

So 100 packages cost about $0.20, and 1,000 about $2.00.

### FAQ

**Where's the data from?**

Google's Open Source Insights (deps.dev), which pulls together the package registries, the OSV vulnerability database and OpenSSF Scorecards. Download counts come from npm and PyPI.

**What do the verdicts mean?**

risky: deprecated, or a vulnerability rated 7 or higher. review: smaller vulnerabilities, a version that doesn't exist, nothing released in 2 years, or a licence worth a look. ok: nothing found.

**What about ranges like ^1.2.0?**

Ranges get checked against the latest version, and it tells you that's what it did. Pin an exact version if you want that one checked.

**Do I pay for a package that doesn't exist?**

Yes, because finding that out is the point. Duplicates and invalid input are free.

### Limitations

- It's only as good as the public vulnerability databases. 'No known issues' doesn't mean it's definitely safe.
- The licence types are a guide, so check anything important properly.
- Download counts are only for npm and PyPI.

### Other tools you might like

- [Security Headers Checker](https://apify.com/somepineapple/security-headers-audit): grade a list of websites on their security headers, A to F.
- [Website Tech Stack Detector](https://apify.com/somepineapple/website-tech-detector-tool): what a website is built with: CMS, frameworks, analytics, hosting.
- [UK & EU Public Tenders Finder](https://apify.com/somepineapple/uk-eu-public-tenders): new government contracts that match your keywords.

### Support

This Actor is built and maintained by an automated system run by its publisher. If something's wrong, open an
issue and it'll be looked at within 7 days. Please don't put passwords or personal details in an issue.

# Actor input Schema

## `packages` (type: `array`):

Names, optionally with a version: requests==2.31.0, npm:react@18.2.0, @angular/core@16.0.0, cargo:serde. Max 300.

## `manifest` (type: `string`):

Paste the whole file and every dependency in it is checked.

## `ecosystem` (type: `string`):

Used for names without a prefix like npm: or pypi:.

## Actor input object example

```json
{
  "packages": [
    "requests==2.25.0",
    "flask",
    "npm:lodash@4.17.15"
  ],
  "ecosystem": "pypi"
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "packages": [
        "requests==2.25.0",
        "flask",
        "npm:lodash@4.17.15"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("somepineapple/package-health-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "packages": [
        "requests==2.25.0",
        "flask",
        "npm:lodash@4.17.15",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("somepineapple/package-health-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "packages": [
    "requests==2.25.0",
    "flask",
    "npm:lodash@4.17.15"
  ]
}' |
apify call somepineapple/package-health-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,somepineapple/package-health-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/ApzSfdVJRZtiXKRKZ/builds/T2o7dCQzL2ItA5BW6/openapi.json