OSV.dev is Google's open, free vulnerability database. It covers npm, PyPI and many other ecosystems, and it has a public API that needs no key. I built some small tools around a single question: does this exact package version have known advisories?
The raw query
curl -s https://api.osv.dev/v1/query \
-d '{"package":{"name":"lodash","ecosystem":"npm"},"version":"4.17.15"}'
When I ran this on 2026-11-01, it returned 6 advisories for lodash@4.17.15:
| GHSA | CVE | Summary |
|---|---|---|
| GHSA-29mw-wpgm-hmr9 | CVE-2020-28500 | ReDoS |
| GHSA-35jh-r3h4-6jhm | CVE-2021-23337 | Command injection |
| GHSA-p6mc-m468-83gw | CVE-2020-8203 | Prototype pollution |
| GHSA-xxjr-mmjv-4gpg | CVE-2025-13465 | Prototype pollution in _.unset / _.omit
|
| GHSA-f23m-r3pf-42rh | CVE-2026-2950 | Prototype pollution via array path bypass |
| GHSA-r5fr-rjxr-66jc | CVE-2026-4800 | Code injection via _.template imports |
The count will change as advisories are added, so run the query yourself.
1. In the editor
Agent Package Advisory is on Open VSX, which VSCodium, Cursor, Gitpod and others use. When you open or save package.json or requirements*.txt, it puts a warning on each pinned dependency that has advisories. The only data it sends to api.osv.dev is package names and versions.
Limits: it checks exact versions only. It doesn't read lockfiles or transitive dependencies. No warning does not mean the package is safe.
2. In CI
agent-advisory-gate is a GitHub Action that fails the PR when the MCP servers in your repo config have CRITICAL or HIGH advisories.
3. Over HTTP
The same lookup is on RapidAPI at agent-package-advisory-check:
GET /check?pkg=lodash&ecosystem=npm&version=4.17.15
The Basic plan is free for 100 requests a month. This is handy for bots and agents that can't install a CLI.
4. On Apify
osv-package-checker takes a list of packages as input and returns a dataset. It's free while in beta.
Why not just npm audit?
npm audit works well for npm lockfiles. These tools target other cases: a mixed requirements.txt and package.json setup, an AI agent that wants to check a package before it installs it, or a quick check from an editor that doesn't run your toolchain.
Feedback and issues are welcome on GitHub.
Top comments (0)