Dependency Risk Check for npm & PyPI

Paste a package.json, a requirements.txt or a plain list of packages and get one row per package that answers the question every developer, security team and AI coding agent asks before installing something: is this dependency safe to use?

For every package version you get:

• Known vulnerabilities for that exact version from OSV.dev, with severity and CVSS score
• Exploit probability for each CVE from EPSS by FIRST – how likely it is to be exploited in the next 30 days
• Actively exploited? – whether a CVE is in the CISA Known Exploited Vulnerabilities catalog
• Upgrade suggestion – the smallest version that fixes all known vulnerabilities
• Repository health – the OpenSSF Scorecard score (0–10) and its weak checks
• License – declared license from ClearlyDefined or the registry, classified as permissive, weak copyleft, strong copyleft or unknown
• End-of-life status – whether the release line is still supported, for products tracked by endoflife.date (Django, React, Angular, Node.js frameworks and more)
• Deprecated or yanked releases
• One risk score from 0 to 100 with a level (low, medium, high, critical) and plain-English findings

Free alternatives give you some of this. This Actor gives you all of it in a single call, with no API keys, ready for spreadsheets, CI pipelines and AI agents.

Who it is for

• AI coding agents and MCP clients that should check a package before suggesting or installing it
• DevSecOps and platform teams that want a quick risk report for a repository or a whole list of services
• Compliance and legal teams checking licenses across dependencies
• Agencies and consultants auditing a client project before taking it over

Input

Use any combination of these fields:

Field	Example
packages	["npm:lodash@4.17.20", "npm:@babel/core@^7", "pypi:requests==2.25.0", "express"]
packageJson	the full text of a package.json (ranges like ^4.18.0 are resolved to the highest matching version)
requirementsTxt	the full text of a requirements.txt (pinned == versions are checked exactly, others use the latest release)
includeDevDependencies	also check devDependencies
defaultEcosystem	npm or pypi for entries without a prefix

Each check (vulnerabilities, Scorecard, license, end-of-life) can be switched off to make runs faster. Without a version, the latest release is checked.

{
    "packages": ["npm:lodash@4.17.20", "pypi:django==3.2.0"],
    "requirementsTxt": "requests==2.25.0\nflask>=2.0"
}

Output

One dataset item per package. The Risk overview table shows the most important columns; the full JSON contains all details.

{
    "ecosystem": "npm",
    "package": "lodash",
    "version": "4.17.20",
    "riskScore": 47,
    "riskLevel": "high",
    "flags": [
        "2 known vulnerabilities (1 high, 1 medium)",
        "Low OpenSSF Scorecard score (4.2/10)",
        "This version was released over 6 years ago"
    ],
    "suggestedVersion": "4.17.21",
    "licenseDeclared": "MIT",
    "licenseCategory": "permissive",
    "vulnerabilityCount": 2,
    "maxEpss": 0.01234,
    "inKev": false,
    "scorecardScore": 4.2,
    "isEndOfLife": null,
    "repository": "https://github.com/lodash/lodash",
    "vulnerabilities": {
        "count": 2,
        "critical": 0,
        "high": 1,
        "medium": 1,
        "low": 0,
        "kevCount": 0,
        "maxEpss": 0.01234,
        "items": [
            {
                "id": "GHSA-35jh-r3h4-6jhm",
                "cves": ["CVE-2021-23337"],
                "severity": "HIGH",
                "cvssScore": 7.2,
                "summary": "Command Injection in lodash",
                "epss": 0.01234,
                "epssPercentile": 0.85,
                "inKev": false,
                "fixedIn": ["4.17.21"],
                "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm"
            }
        ]
    },
    "scorecard": { "score": 4.2, "date": "2026-10-20", "weakChecks": ["Maintained"] },
    "license": { "declared": "MIT", "source": "ClearlyDefined", "category": "permissive" },
    "support": null,
    "errors": []
}

Example values are illustrative. If one data source is temporarily unavailable, the package is still reported and the problem is listed in errors.

How the risk score works

The score is a transparent heuristic, not a verdict:

• The most severe vulnerability counts most (critical 40, high 25, medium 12, low 5 points), plus 30 if it is in CISA KEV or 15 if its EPSS is 10 % or higher, plus 5 for every further vulnerability (capped at 70)
• Up to 20 points for a weak OpenSSF Scorecard score
• 10 points for an unknown or non-open license, 8 for strong copyleft
• 15 points if the release is deprecated or yanked, 15 if its release line is end-of-life
• 5 points if the version is more than three years old

0–19 is low, 20–44 medium, 45–69 high, 70–100 critical.

Pricing

Pay per result: $0.006 per package that exists in the registry and was checked, so a project with 50 dependencies costs $0.30. Packages or versions that cannot be found are listed for free. Set a maximum cost per run in the run options and the Actor stops cleanly when it is reached.

Use it from code or an AI agent

Run it through the Apify API, the Apify client for JavaScript or Python, or let AI agents call it as a tool through the Apify MCP server.

Data sources and licenses

Source	Used for	License
npm registry, PyPI	versions, license, repository, deprecation	public registry metadata
ClearlyDefined	declared license, release date, source repository	CC0-1.0
OpenSSF Scorecard	repository health	CDLA-Permissive-2.0
OSV.dev	vulnerabilities	per advisory database, mostly CC-BY-4.0
EPSS by FIRST	exploit probability	free use, attribution to FIRST.org
CISA KEV	actively exploited CVEs	public domain
endoflife.date	support and end-of-life dates	MIT

This Actor reads only public package metadata and contains no personal data. Results are for information and prioritization; they are not legal advice and do not replace a full security review.