Package Vulnerability Checker
Check a package and version against OSV.dev for known CVEs — npm, PyPI, Go, crates.io, Maven, RubyGems, Packagist, NuGet. Free, live, no signup.
Live OSV.dev query — nothing storedFrequently asked questions
Which package ecosystems are supported?
npm, PyPI, Go, crates.io, Maven, RubyGems, Packagist and NuGet -- all backed by OSV.dev, Google's Open Source Vulnerabilities database.
Why check a version I've used for years?
New vulnerabilities get disclosed against old, previously-considered-safe versions all the time. A version that looked clean a year ago can have real, newly-published CVEs today -- checking against a live database catches this in a way a one-time audit can't.
What does it mean if a version is missing entirely?
An empty result means no known vulnerabilities were found for that exact package/version in OSV.dev -- it does not mean the package has been fully audited or is guaranteed safe, only that nothing has been publicly disclosed there yet.
Can I use this in my own code?
Yes. This page calls the same free, public API endpoint you can call directly: GET /api/vulnerability-check?ecosystem=npm&package=lodash&version=4.17.15. No signup or API key required.