Dependency Audit API

Find known vulnerabilities (OSV.dev), fixed versions, latest releases and licences for the packages in a lockfile or manifest: npm, pip, Go, Composer…

Parameters

Example

curl -X POST "https://apibox.io.vn/v1/dep-audit" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content":"{\"dependencies\":{\"lodash\":\"4.17.20\"}}","filename":"package.json","latest":true}'

const res = await fetch('https://apibox.io.vn/v1/dep-audit', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "content": "{\"dependencies\":{\"lodash\":\"4.17.20\"}}",
    "filename": "package.json",
    "latest": true
  }),
});
const data = await res.json();
console.log(data);

import requests

res = requests.post(
    "https://apibox.io.vn/v1/dep-audit",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"content": "{\"dependencies\":{\"lodash\":\"4.17.20\"}}", "filename": "package.json", "latest": True},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/dep-audit');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => '{"content":"{\\"dependencies\\":{\\"lodash\\":\\"4.17.20\\"}}","filename":"package.json","latest":true}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

Response

{
  "format": "package.json",
  "packages_total": 1,
  "summary": {
    "vulnerable_packages": 1,
    "vulnerabilities": 4,
    "by_severity": {
      "high": 2,
      "medium": 2
    },
    "outdated_packages": 1,
    "latest_checked": 1,
    "licences": {
      "MIT": 1
    },
    "copyleft_packages": 0
  },
  "packages": [
    {
      "name": "lodash",
      "version": "4.17.20",
      "ecosystem": "npm",
      "declared": "4.17.20",
      "dev": false,
      "direct": true,
      "vulnerable": true,
      "vulnerabilities": [
        {
          "id": "GHSA-35jh-r3h4-6jhm",
          "aliases": [
            "CVE-2021-23337"
          ],
          "summary": "Command Injection in lodash",
          "severity": "high",
          "cvss_score": 7.2,
          "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "fixed_versions": [
            "4.17.21"
          ],
          "fixed_in": "4.17.21",
          "published": "2021-05-06T16:05:51Z",
          "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm"
        },
        {
          "id": "GHSA-r5fr-rjxr-66jc",
          "aliases": [
            "CVE-2026-4800"
          ],
          "summary": "lodash vulnerable to Code Injection via `_.template` imports key names",
          "severity": "high",
          "cvss_score": 8.1,
          "fixed_versions": [
            "4.18.0"
          ],
          "fixed_in": "4.18.0",
          "url": "https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc"
        },
        "…"
      ],
      "upgrade_to": "4.18.0",
      "latest": "4.18.1",
      "outdated": true,
      "licence": {
        "declared": "MIT",
        "spdx": "MIT",
        "ids": [
          "MIT"
        ],
        "copyleft": "none"
      }
    }
  ],
  "attribution": "Vulnerability data from OSV.dev (https://osv.dev), aggregating GitHub Advisory Database (CC-BY 4.0), PyPA, Go, RustSec and other sources under their licences."
}

Use cases

• Check a project handed over by an agency before taking it into production
• Light vulnerability gate in CI without installing a scanner
• List copyleft licences in dependencies before shipping a product
• See which packages are outdated and which upgrade fixes the advisories

FAQ

Related APIs