npm & PyPI Package Health Check

npm & PyPI Package Health Check checks npm and PyPI packages in bulk for known vulnerabilities (OSV.dev), licence, latest version and release date, deprecation, downloads and maintainers, with an OK / REVIEW / RISK verdict per package.

Best for: Software supply-chain reviews, vendor due diligence, security questionnaires and keeping an eye on dependencies on a schedule.

How to check npm and PyPI packages for vulnerabilities

1. Add packages to Packages: npm:lodash, PyPI:django or {"ecosystem": "npm", "name": "axios", "version": "0.21.0"}.
2. Click Start.
3. Filter on health and riskFlags to find packages to review.

How it works

Uses the public npm registry and download-count APIs, the PyPI JSON API and the OSV.dev vulnerability database (Google's open-source database, data under CC-BY 4.0), all without keys. Flags: KNOWN_VULNERABILITIES, DEPRECATED, NO_RELEASE_2Y, NO_LICENSE_DECLARED, OUTDATED. Unknown packages or bad rows return ok: false and are not charged.

Output

ecosystem, name, checkedVersion, latestVersion, health, riskFlags, vulnerabilityCount, vulnerabilities, license, daysSinceLatestRelease, ok

Pricing (pay-per-event)

• package-checked: $0.0005 per result ($0.5 / 1,000). Platform usage is included; you pay only for results.
• Example: 10,000 packages cost $5.00.

Example input

{
  "packages": [
    "npm:lodash",
    "PyPI:django",
    {
      "ecosystem": "npm",
      "name": "axios",
      "version": "0.21.0"
    }
  ]
}

Example output

Values below are illustrative.

{
  "ecosystem": "PyPI",
  "name": "requests",
  "checkedVersion": "2.19.0",
  "latestVersion": "2.34.2",
  "health": "RISK",
  "riskFlags": [
    "KNOWN_VULNERABILITIES",
    "OUTDATED"
  ],
  "vulnerabilityCount": 5,
  "vulnerabilities": [],
  "license": "Apache-2.0",
  "daysSinceLatestRelease": 152,
  "ok": true
}

Use it via API, schedules and integrations

Run it in Apify Console, or call it from your own code with the Apify API or the Python and JavaScript clients. Save an input as a task and add a schedule to run it regularly, and send results to Slack, email, webhooks, Zapier, Make or n8n with Apify integrations. AI agents can find and run it through the Apify MCP server.

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("sterlingverify/package-health-check").call(run_input={"packages": ["npm:lodash", "PyPI:django"]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

Use in Clay, Zapier, Make, n8n, Pipedream, Power Automate or Activepieces

All of them connect to Apify through their official Apify integrations, using your own Apify account: an API token from Apify Console > Settings > API & Integrations, or Apify sign-in for Power Automate. Runs bill to your Apify account at this Actor's pay-per-event price.

• Clay: save this Actor's input as an Apify task and copy it as JSON. In your Clay table, add the Run Apify Actor enrichment, choose it and paste the JSON into Input Data, mapping Clay columns into the fields. To pull a finished run into a new table, use the Import data from Apify Actor source.
• Zapier: use the Apify Run Actor action, or the Finished Actor run trigger followed by Fetch dataset items. Synchronous runs in Zapier stop after 30 seconds, so use the trigger for big batches.
• Make: add the Apify Run an Actor module with Run synchronously set to Yes, then Get Dataset Items with the run's dataset ID. For longer runs, use the Watch Actor Runs trigger.
• n8n: install the Apify node (@apify/n8n-nodes-apify, or search "Apify" on n8n Cloud) and use Run an Actor and get dataset.
• Pipedream: add the Apify app's Run Actor action, or Run Task Synchronously on one of this Actor's public example tasks (or your own saved task) to get the dataset items back in one step. For big batches, start from the New Finished Actor Run or New Finished Task Run trigger, then Get Dataset Items.
• Power Automate: add the Apify connector (a premium connector, currently in preview) and sign in with your Apify account. Use Run Actor with Enter custom value set to sterlingverify/package-health-check and paste the input as JSON, then Get dataset items with the run's default dataset ID. For big batches, start the flow from the Actor run finished trigger instead.
• Activepieces: add the Apify piece and use Run Actor, or Run Task on one of this Actor's public example tasks (or your own saved task), then Get Dataset Items. For scheduled or big batches, use the Watch Actor Runs or Watch Task Runs trigger.
• Google Drive / Sheets: add Apify's Upload results to GDrive integration to a scheduled task to drop each run's CSV or XLSX into your team's Drive, or chain the Google Sheets Import & Export actor to append rows to a sheet.
• Slack alerts: add Apify's Slack integration to a scheduled task to post each run's results or new alerts to your team channel, or start a check from Slack with /apify call and your task ID.
• Any HTTP tool or script: send one request and get the results back as JSON. Runs must finish within 5 minutes.

curl -X POST "https://api.apify.com/v2/acts/sterlingverify~package-health-check/run-sync-get-dataset-items" \
  -H "Authorization: Bearer YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d @input.json

FAQ

Where does the vulnerability data come from?

OSV.dev, Google's open-source vulnerability database (CC-BY 4.0), plus the public npm and PyPI APIs. No keys needed.

Is this a full security audit?

No. Vulnerability data can lag, and it doesn't know whether your code uses the affected function.

Disclaimer

An automated aid, not a full security audit: vulnerability data can lag and doesn't account for whether your code actually uses the affected function. Not affiliated with npm, PyPI, the PSF or OSV.

Related sterlingVerify tools

Part of the sterlingVerify UK payments, KYB and data toolkit on Apify Store:

• SSL Certificate Expiry Monitor: bulk SSL certificate expiry checks and alerts
• PSP Status Monitor: outage alerts from payment provider status pages
• Structured Data Extractor: schema.org JSON-LD and Open Graph data from any page