Is this package version vulnerable or malicious?
check_packageRead-onlyIdempotent
Checks one package version (npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven, NuGet) against OSV.dev. Free preview tier: verdict and advisory count. The paid x402 endpoint /v1/package adds advisory ids, severity, CVSS and fixed-in versions.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Package name, e.g. lodash | |
| version | Yes | Exact version, e.g. 4.17.15 | |
| ecosystem | No | One of npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven, NuGet, Pub, Hex (default npm) |