# Dependency Risk Check for npm & PyPI (`uxz7/dependency-risk-check`) Actor

Check npm and PyPI packages in one call: known vulnerabilities with EPSS exploit probability and CISA KEV status, OpenSSF Scorecard, license and end-of-life status, plus a 0-100 risk score and an upgrade suggestion.

- **URL**: https://apify.com/uxz7/dependency-risk-check.md
- **Developed by:** [uxz7](https://apify.com/uxz7) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $6.00 / 1,000 package checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Dependency Risk Check for npm & PyPI

Paste a `package.json`, a `requirements.txt` or a plain list of packages and get one row per package that answers the question every developer, security team and AI coding agent asks before installing something: **is this dependency safe to use?**

For every package version you get:

- **Known vulnerabilities** for that exact version from [OSV.dev](https://osv.dev), with severity and CVSS score
- **Exploit probability** for each CVE from [EPSS by FIRST](https://www.first.org/epss) – how likely it is to be exploited in the next 30 days
- **Actively exploited?** – whether a CVE is in the [CISA Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) catalog
- **Upgrade suggestion** – the smallest version that fixes all known vulnerabilities
- **Repository health** – the [OpenSSF Scorecard](https://securityscorecards.dev) score (0–10) and its weak checks
- **License** – declared license from [ClearlyDefined](https://clearlydefined.io) or the registry, classified as permissive, weak copyleft, strong copyleft or unknown
- **End-of-life status** – whether the release line is still supported, for products tracked by [endoflife.date](https://endoflife.date) (Django, React, Angular, Node.js frameworks and more)
- **Deprecated or yanked** releases
- **One risk score from 0 to 100** with a level (`low`, `medium`, `high`, `critical`) and plain-English findings

Free alternatives give you some of this. This Actor gives you all of it in a single call, with no API keys, ready for spreadsheets, CI pipelines and AI agents.

### Who it is for

- **AI coding agents and MCP clients** that should check a package before suggesting or installing it
- **DevSecOps and platform teams** that want a quick risk report for a repository or a whole list of services
- **Compliance and legal teams** checking licenses across dependencies
- **Agencies and consultants** auditing a client project before taking it over

### Input

Use any combination of these fields:

| Field | Example |
|---|---|
| `packages` | `["npm:lodash@4.17.20", "npm:@babel/core@^7", "pypi:requests==2.25.0", "express"]` |
| `packageJson` | the full text of a `package.json` (ranges like `^4.18.0` are resolved to the highest matching version) |
| `requirementsTxt` | the full text of a `requirements.txt` (pinned `==` versions are checked exactly, others use the latest release) |
| `includeDevDependencies` | also check `devDependencies` |
| `defaultEcosystem` | `npm` or `pypi` for entries without a prefix |

Each check (vulnerabilities, Scorecard, license, end-of-life) can be switched off to make runs faster. Without a version, the latest release is checked.

```json
{
    "packages": ["npm:lodash@4.17.20", "pypi:django==3.2.0"],
    "requirementsTxt": "requests==2.25.0\nflask>=2.0"
}
```

### Output

One dataset item per package. The **Risk overview** table shows the most important columns; the full JSON contains all details.

```json
{
    "ecosystem": "npm",
    "package": "lodash",
    "version": "4.17.20",
    "riskScore": 47,
    "riskLevel": "high",
    "flags": [
        "2 known vulnerabilities (1 high, 1 medium)",
        "Low OpenSSF Scorecard score (4.2/10)",
        "This version was released over 6 years ago"
    ],
    "suggestedVersion": "4.17.21",
    "licenseDeclared": "MIT",
    "licenseCategory": "permissive",
    "vulnerabilityCount": 2,
    "maxEpss": 0.01234,
    "inKev": false,
    "scorecardScore": 4.2,
    "isEndOfLife": null,
    "repository": "https://github.com/lodash/lodash",
    "vulnerabilities": {
        "count": 2,
        "critical": 0,
        "high": 1,
        "medium": 1,
        "low": 0,
        "kevCount": 0,
        "maxEpss": 0.01234,
        "items": [
            {
                "id": "GHSA-35jh-r3h4-6jhm",
                "cves": ["CVE-2021-23337"],
                "severity": "HIGH",
                "cvssScore": 7.2,
                "summary": "Command Injection in lodash",
                "epss": 0.01234,
                "epssPercentile": 0.85,
                "inKev": false,
                "fixedIn": ["4.17.21"],
                "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm"
            }
        ]
    },
    "scorecard": { "score": 4.2, "date": "2026-10-20", "weakChecks": ["Maintained"] },
    "license": { "declared": "MIT", "source": "ClearlyDefined", "category": "permissive" },
    "support": null,
    "errors": []
}
```

Example values are illustrative. If one data source is temporarily unavailable, the package is still reported and the problem is listed in `errors`.

### How the risk score works

The score is a transparent heuristic, not a verdict:

- The most severe vulnerability counts most (critical 40, high 25, medium 12, low 5 points), plus 30 if it is in CISA KEV or 15 if its EPSS is 10 % or higher, plus 5 for every further vulnerability (capped at 70)
- Up to 20 points for a weak OpenSSF Scorecard score
- 10 points for an unknown or non-open license, 8 for strong copyleft
- 15 points if the release is deprecated or yanked, 15 if its release line is end-of-life
- 5 points if the version is more than three years old

0–19 is `low`, 20–44 `medium`, 45–69 `high`, 70–100 `critical`.

### Pricing

Pay per result: **$0.006 per package** that exists in the registry and was checked, so a project with 50 dependencies costs $0.30. Packages or versions that cannot be found are listed for free. Set a maximum cost per run in the run options and the Actor stops cleanly when it is reached.

### Use it from code or an AI agent

Run it through the [Apify API](https://docs.apify.com/api/v2), the Apify client for JavaScript or Python, or let AI agents call it as a tool through the [Apify MCP server](https://mcp.apify.com).

### Data sources and licenses

| Source | Used for | License |
|---|---|---|
| npm registry, PyPI | versions, license, repository, deprecation | public registry metadata |
| ClearlyDefined | declared license, release date, source repository | CC0-1.0 |
| OpenSSF Scorecard | repository health | [CDLA-Permissive-2.0](https://cdla.dev/permissive-2-0/) |
| OSV.dev | vulnerabilities | per advisory database, mostly CC-BY-4.0 |
| EPSS by FIRST | exploit probability | free use, attribution to FIRST.org |
| CISA KEV | actively exploited CVEs | public domain |
| endoflife.date | support and end-of-life dates | MIT |

This Actor reads only public package metadata and contains no personal data. Results are for information and prioritization; they are not legal advice and do not replace a full security review.

# Actor input Schema

## `packages` (type: `array`):

One package per line. Formats: npm:lodash@4.17.20, npm:@babel/core@^7, pypi:requests==2.25.0, or just a name (uses the default ecosystem). Without a version the latest version is checked.

## `packageJson` (type: `string`):

Paste the full content of a package.json. Version ranges are resolved to the highest matching version.

## `includeDevDependencies` (type: `boolean`):

Also check devDependencies from the pasted package.json.

## `requirementsTxt` (type: `string`):

Paste the content of a requirements.txt. Pinned versions (==) are checked exactly, everything else uses the latest release.

## `defaultEcosystem` (type: `string`):

Used for entries in Packages that have no npm: or pypi: prefix.

## `checkVulnerabilities` (type: `boolean`):

Known vulnerabilities for the exact version, with exploit probability and whether they are actively exploited.

## `checkScorecard` (type: `boolean`):

Security practices of the source repository, 0 to 10.

## `checkLicense` (type: `boolean`):

Declared license and its category (permissive, weak copyleft, strong copyleft, unknown).

## `checkSupportStatus` (type: `boolean`):

Whether the release line is still supported, for products tracked by endoflife.date (e.g. django, react, angular).

## `maxPackages` (type: `integer`):

Upper limit of packages checked in one run.

## `maxConcurrency` (type: `integer`):

How many packages are checked at the same time.

## Actor input object example

```json
{
  "packages": [
    "npm:lodash@4.17.20",
    "npm:express",
    "pypi:requests==2.25.0",
    "pypi:django==3.2.0"
  ],
  "includeDevDependencies": false,
  "defaultEcosystem": "npm",
  "checkVulnerabilities": true,
  "checkScorecard": true,
  "checkLicense": true,
  "checkSupportStatus": true,
  "maxPackages": 500,
  "maxConcurrency": 5
}
```

# Actor output Schema

## `results` (type: `string`):

No description

## `summary` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "packages": [
        "npm:lodash@4.17.20",
        "npm:express",
        "pypi:requests==2.25.0",
        "pypi:django==3.2.0"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("uxz7/dependency-risk-check").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "packages": [
        "npm:lodash@4.17.20",
        "npm:express",
        "pypi:requests==2.25.0",
        "pypi:django==3.2.0",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("uxz7/dependency-risk-check").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "packages": [
    "npm:lodash@4.17.20",
    "npm:express",
    "pypi:requests==2.25.0",
    "pypi:django==3.2.0"
  ]
}' |
apify call uxz7/dependency-risk-check --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,uxz7/dependency-risk-check"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/DAWIRuHlSKNMf9arT/builds/B3s4hgpkxLaj6jSoM/openapi.json