Open Source Dependency Vulnerability Scanner

Scan your software dependencies against OSV.dev — Google's Open Source Vulnerabilities database, which aggregates GitHub Security Advisories, PyPA, RustSec, the Go vulnerability database, npm and many more into one schema. Supply a list of packages and get one row per known vulnerability: the OSV/GHSA id, CVE aliases, severity, CWEs, the affected version range, and the version that fixes it.

No API key, no account. Packages with no known vulnerabilities produce no rows and cost nothing — so scanning a clean tree is effectively free. Turn on dedupe with a schedule to be alerted only when a new vulnerability starts affecting something you ship.

Who uses it

• Engineering & DevSecOps — a scheduled check over the dependencies you ship, without wiring a scanner into every repo.
• Security teams / MSPs — audit a client's stack from a plain package list (SBOM export, package-lock.json, requirements.txt, go.mod).
• Procurement & due diligence — check a vendor's declared dependencies before you sign.

Pairs with the CVE Vulnerability Tracker (which discovers CVEs by vendor/product across NVD) — this actor answers the complementary question: do my exact versions have known issues, and what do I upgrade to?

Input

Provide packages as ecosystem:name@version entries:

npm:lodash@4.17.15
PyPI:django@3.2.0
Go:github.com/gin-gonic/gin@1.6.0
Maven:com.fasterxml.jackson.core:jackson-databind@2.9.8
crates.io:openssl@0.10.0

• Omit @version to get all known vulnerabilities for a package.
• The ecosystem: prefix is optional if you set a default ecosystem.
• Supported ecosystems: npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist, Pub, Hex and more. Common aliases (pip, cargo, gem, golang, …) are accepted.

Field	Description
packages	Dependency list, one ecosystem:name@version per entry.
ecosystem	Default ecosystem for entries with no prefix.
severityMin	Keep only low/moderate/high/critical and above. Unrated vulns are always kept.
includeCleanRows	Also emit a row for packages with no vulnerabilities. Off by default.
maxRows	Cap on rows per run.
dedupe	Remember package+vulnerability pairs across runs; only return new ones. Use with a schedule.

Output

One row per vulnerability: package, ecosystem, queriedVersion, vulnId, aliases, cve, severity, cvssVector, cwe, summary, firstPatchedVersion, fixedVersions, introducedVersions, references, published, modified, url.

Pricing

Pay per event: $0.004 per vulnerability row. Clean packages cost nothing. The first 2 rows of every run are free.

Data source: OSV.dev (open data, CC-BY-4.0).