Dependency Vulnerability Check Online

Find known vulnerabilities (OSV.dev), fixed versions, latest releases and licences for the packages in a lockfile or manifest: npm, pip, Go, Composer…

Result

Press “Run” to see the result.

Upload or paste a manifest or lockfile: package.json, package-lock.json (v1–v3), yarn.lock (classic and Berry), pnpm-lock.yaml, requirements.txt, poetry.lock, Pipfile.lock, composer.lock / composer.json, go.sum / go.mod, Gemfile.lock or Cargo.lock. The format is detected from filename or the content. Every package and version is checked against OSV.dev (Google’s open vulnerability database, which aggregates the GitHub Advisory Database, PyPA, Go, RustSec and others) in batches of up to 1,000.

Each vulnerable package lists its advisories with GHSA / CVE ids, summary, severity (computed from the CVSS v3 vector, or the advisory’s own rating), the versions that fix it and fixed_in (the first fixed version above yours); upgrade_to is the lowest version that fixes all of them. With latest=true the latest release is fetched from npm, PyPI or Packagist for direct dependencies (all packages for small files). Licences from the lockfile or registry are normalised to SPDX (spdx-correct) and flagged as weak, strong or network copyleft.

For manifests with ranges (^1.2.3, >=3.0) the lowest allowed version is checked and marked version_from_range: use a lockfile for exact results. Advisory details are cached for a day and fetched for at most 150 advisories per call (max_details, up to 300). Vulnerability data: OSV.dev, credited in each response.

Use this in your code

curl -X POST "https://apibox.io.vn/v1/dep-audit" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content":"{\"dependencies\":{\"lodash\":\"4.17.20\"}}","filename":"package.json","latest":true}'

const res = await fetch('https://apibox.io.vn/v1/dep-audit', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "content": "{\"dependencies\":{\"lodash\":\"4.17.20\"}}",
    "filename": "package.json",
    "latest": true
  }),
});
const data = await res.json();
console.log(data);

import requests

res = requests.post(
    "https://apibox.io.vn/v1/dep-audit",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"content": "{\"dependencies\":{\"lodash\":\"4.17.20\"}}", "filename": "package.json", "latest": True},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/dep-audit');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => '{"content":"{\\"dependencies\\":{\\"lodash\\":\\"4.17.20\\"}}","filename":"package.json","latest":true}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

Where does the vulnerability data come from?

From OSV.dev, the open database run by Google that merges the GitHub Advisory Database, PyPA, Go vulndb, RustSec, RubySec and other sources. Each response carries the attribution.

Why do I see version_from_range?

package.json, composer.json and requirements.txt with >= only give ranges. The API checks the lowest version the range allows; the version you actually install may be newer. Send the lockfile for exact versions.

Is pom.xml or build.gradle supported?

Not yet. Supported: npm, yarn, pnpm, pip, Poetry, Pipenv, Composer, Go modules, Bundler and Cargo files.