Dependency security / exact versions

npm and PyPI Vulnerability API

Check exact npm and PyPI versions against registry metadata, OSV vulnerabilities, and CISA KEV with visible source status. This page describes the public input, source boundary, and launch pricing before you run anything.

$0.0015per package record
launch price

Current event price$0.0015 per package record + $0.00005 per start

Public sourcenpm, PyPI, OSV, and CISA KEV

DeliveryJSON / CSV / Excel / n8n

Three-step flow

How it works

Resolve the exact requested version against its public registry.
Query OSV and match returned CVEs against the CISA KEV catalog.
Keep partial and failed source states visible to downstream alerts.

Copyable starting point

Example input

{
  "packages": [
    {"name": "lodash", "ecosystem": "npm", "version": "4.17.20"},
    {"name": "requests", "ecosystem": "PyPI", "version": "2.31.0"}
  ],
  "includeVulnerabilities": true,
  "includeCisaKev": true
}

Decision boundary

No private package, registry login, or repository credential access.
A source error is not converted into a clean vulnerability result.
Does not update dependencies or certify that a package is safe.
Use installed lockfile versions, not a floating latest tag.
Check the current Store price in your own account before scheduling.

Open exact-version scan Actor and API docs Open n8n workflow