{"uid":"cap_bIPTLpyYutdqeJEklZDfw","slug":"sitecheck-package-vulnerability-scanner-06c14988","name":"SiteCheck Package Vulnerability Scanner","description":"Known vulnerabilities of one package version in the OSV database: npm, PyPI, crates.io, Go or Maven. Each advisory has its id, CVE aliases, summary, severity, fixed versions and a link. The count is the full number; up to 20 are listed.","url":"https://api.sitecheck-api.workers.dev/api/vulns?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ecosystem","name","version"],"properties":{"name":{"type":"string","description":"Package name"},"version":{"type":"string","description":"Exact version, e.g. 4.17.20"},"ecosystem":{"type":"string","description":"npm, PyPI, crates.io, Go or Maven"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"name":"lodash","note":"Advisories that OSV lists for this exact version.","count":5,"source":"OSV (https://osv.dev), no API key","version":"4.17.20","checkedAt":"2026-10-14T04:49:24.880Z","ecosystem":"npm","vulnerabilities":[{"id":"GHSA-29mw-wpgm-hmr9","link":"https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9","aliases":["CVE-2020-28500"],"fixedIn":["4.17.21"],"summary":"Regular Expression Denial of Service (ReDoS) in lodash","severity":"MODERATE"},{"id":"GHSA-35jh-r3h4-6jhm","link":"https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm","aliases":["CVE-2021-23337","CVE-2026-4800"],"fixedIn":["4.17.21"],"summary":"Command Injection in lodash","severity":"HIGH"}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_-4jsgK6YnOnkTM49awQOT","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Looks up known security vulnerabilities for a specific package version across npm, PyPI, crates.io, Go, or Maven ecosystems using the OSV database","exampleAgentPrompt":"Can you check whether lodash version 4.17.20 on npm has any known security vulnerabilities, and tell me the severity and what version fixes each one?","exampleUseCases":[{"title":"Audit npm dependency before shipping","prompt":"Before I push this release, can you check if react-scripts version 5.0.1 on npm has any known CVEs or security advisories, and flag anything HIGH or CRITICAL?"},{"title":"Python library vulnerability check","prompt":"I'm using requests version 2.27.1 from PyPI in my backend — does it have any known vulnerabilities I should be aware of, and is there a patched version available?"},{"title":"Cargo crate security audit","prompt":"Check the crates.io package serde version 1.0.130 for any known security advisories from the OSV database and tell me their severity levels."}],"resultDescription":"Returns a JSON object containing the package name, version, ecosystem, total advisory count, timestamp, and an array of vulnerability objects. Each vulnerability includes its OSV/GHSA ID, a link to the full advisory, CVE aliases, the version(s) that fix the issue, a plain-English summary, and a severity rating (e.g. LOW, MODERATE, HIGH, CRITICAL).","failureModes":["Missing required parameters (ecosystem, name, version) returns a validation error","Unknown or misspelled ecosystem name may return no results or an error","Package not found in the specified ecosystem returns empty vulnerability list","OSV upstream unavailability may cause timeout or degraded response","Incorrect version string format may return no matches even if vulnerabilities exist"],"whenToPreferThis":"Choose this endpoint when you need to check a specific, pinned version of a package against the OSV vulnerability database across major ecosystems (npm, PyPI, crates.io, Go, Maven). It is ideal for CI/CD pipelines, dependency audits before deployment, or agent-driven security reviews where the exact package coordinates are known. It uses OSV directly with no API key required, making it a lightweight, pay-per-call alternative to full SCA platforms.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-19T06:44:35.797Z","isFirstParty":false,"canonicalSlug":"sitecheck-package-vulnerability-scanner-06c14988"}