npm & PyPI Package Health Check

npm & PyPI Package Health Check checks npm and PyPI packages in bulk for known vulnerabilities (OSV.dev), licence, latest version and release date, deprecation, downloads and maintainers, with an OK / REVIEW / RISK verdict per package.

Best for: Software supply-chain reviews, vendor due diligence, security questionnaires and keeping an eye on dependencies on a schedule.

How to check npm and PyPI packages for vulnerabilities

1. Add packages to Packages: npm:lodash, PyPI:django or {"ecosystem": "npm", "name": "axios", "version": "0.21.0"}.
2. Click Start.
3. Filter on health and riskFlags to find packages to review.

How it works

Uses the public npm registry and download-count APIs, the PyPI JSON API and the OSV.dev vulnerability database (Google's open-source database, data under CC-BY 4.0), all without keys. Flags: KNOWN_VULNERABILITIES, DEPRECATED, NO_RELEASE_2Y, NO_LICENSE_DECLARED, OUTDATED. Unknown packages or bad rows return ok: false and are not charged.

Output

ecosystem, name, checkedVersion, latestVersion, health, riskFlags, vulnerabilityCount, vulnerabilities, license, daysSinceLatestRelease, ok

Pricing (pay-per-event)

• package-checked: $0.0005 per result ($0.5 / 1,000). Platform usage is included; you pay only for results.
• Example: 10,000 packages cost $5.00.

Example input

{
  "packages": [
    "npm:lodash",
    "PyPI:django",
    {
      "ecosystem": "npm",
      "name": "axios",
      "version": "0.21.0"
    }
  ]
}

Example output

Values below are illustrative.

{
  "ecosystem": "PyPI",
  "name": "requests",
  "checkedVersion": "2.19.0",
  "latestVersion": "2.34.2",
  "health": "RISK",
  "riskFlags": [
    "KNOWN_VULNERABILITIES",
    "OUTDATED"
  ],
  "vulnerabilityCount": 5,
  "vulnerabilities": [],
  "license": "Apache-2.0",
  "daysSinceLatestRelease": 152,
  "ok": true
}

Use it via API, schedules and integrations

Run it in Apify Console, or call it from your own code with the Apify API or the Python and JavaScript clients. Save an input as a task and add a schedule to run it regularly, and send results to Slack, email, webhooks, Zapier, Make or n8n with Apify integrations. AI agents can find and run it through the Apify MCP server.

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("sterlingverify/package-health-check").call(run_input={"packages": ["npm:lodash", "PyPI:django"]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

FAQ

Where does the vulnerability data come from?

OSV.dev, Google's open-source vulnerability database (CC-BY 4.0), plus the public npm and PyPI APIs. No keys needed.

Is this a full security audit?

No. Vulnerability data can lag, and it doesn't know whether your code uses the affected function.

Disclaimer

An automated aid, not a full security audit: vulnerability data can lag and doesn't account for whether your code actually uses the affected function. Not affiliated with npm, PyPI, the PSF or OSV.

Related sterlingVerify tools

Part of the sterlingVerify UK payments, KYB and data toolkit on Apify Store:

• SSL Certificate Expiry Monitor: bulk SSL certificate expiry checks and alerts
• PSP Status Monitor: outage alerts from payment provider status pages
• Structured Data Extractor: schema.org JSON-LD and Open Graph data from any page