Dependency exposure check
Paste a lockfile to see whether any exact package version in it has a published vulnerability or is recorded as malicious in the public OSV database. The check finds only known, published issues: a clean result is not proof that a package is safe.
Runs in your browser. When you press Check, your browser sends package names and versions (never file contents or paths) to the public OSV database at osv.dev. Nothing is sent to us.
Paste a package-lock.json (versions 1 to 3), requirements.txt, yarn.lock or pnpm-lock.yaml, or choose the file. It is read on this page and never uploaded.
Check sends only package names and exact versions to osv.dev.
How the check works
The file is read in your browser. From an npm package-lock.json (lockfile versions 1, 2 and 3), a yarn.lock, a pnpm-lock.yaml (versions 5, 6 and 9) or a Python requirements.txt, it takes each package name and exact version. In a requirements.txt, only lines pinned with == name an exact version; other lines are listed as not pinned and not checked. Packages from git, local folders or URLs are skipped.
When you press Check, your browser asks the OSV database at osv.dev which records match those versions, then fetches each record for its summary, its other identifiers (such as CVE and GHSA), its severity and the version that fixes it. OSV brings together advisories from sources such as the GitHub Advisory Database, the Python Packaging Advisory Database and the OpenSSF malicious packages project.
What it does not find. Issues that haven’t been published yet, malicious releases that haven’t been reported, and problems in your own code. A lockfile also records what was installed at one point in time; what is installed on each computer or in each build may differ.
Severity. Shown only as the source states it. Where a record gives a CVSS 3 vector, the base score is worked out from it. Nothing is labelled critical unless the source says so.