How to check any package version for known vulnerabilities with the free OSV API
- Steps
- 6
- Hands-on
- 10 min
- Reading
- 5 min
- Checked
- Oct 27
The short version
Send one POST to https://api.osv.dev/v1/query with the package name, ecosystem and exact version, and you get back every known advisory that affects it, with the fixed version. It is free, needs no key, and covers npm, PyPI, crates.io, Go, Maven and more. For a whole project, run osv-scanner on your lockfile.
What you need
- curl (built into Windows 10+, macOS and Linux)
- A package name and version, or a lockfile
- Optional: Go or a release binary for osv-scanner
Part of the article OpenClaw got 591 advisories. 1 in 4 top npm installs is the real hole. This page answers one question from it in depth.
On this page · 13 sections
TL;DR: We queried OSV.dev live on Oct 27 2026: minimatch 3.0.4 returns 4 advisories, all high, fixed in 3.1.4; brace-expansion 1.1.11 returns 8; axios 1.6.0 returns 31; lodash 4.17.21 returns 3. npm alone got 363 GitHub-reviewed advisories from Oct 1 to Oct 23 2026. Ten minutes with this guide and you know which of yours are in that list.
Advisories now land faster than anyone reads them. March 2026 alone brought 603 npm advisories in the GitHub database, per our npm advisories breakdown. You do not need a paid scanner to keep up. The same data the paid tools resell is one HTTP call away, and an agent can make that call as easily as you can.
Live OSV.dev answers, Oct 27 2026. Counts include every severity and every year.
Key facts
| What | Number | Source (checked Oct 27 2026) |
|---|---|---|
| Advisories for axios 1.6.0 | 31 | OSV.dev querybatch |
| Advisories for minimatch 3.0.4 / fixed in | 4 / 3.1.4 | OSV.dev query |
| Advisories for brace-expansion 1.1.11 | 8 | OSV.dev query |
| npm advisories, Oct 1-23 2026 | 363 | Our data.csv |
| npm advisories, peak month of 2026 (March) | 603 | Our data.csv |
| API key or price | None, $0 | OSV.dev docs |
Before you start
Check the version you actually run, not the range in package.json. "minimatch": "^3.0.4" could resolve to a fixed 3.1.4 or a stale 3.0.4 depending on when the lockfile was written. The lockfile is the truth.
Step 01: Pick the exact version
npm ls minimatch
This prints every copy in your tree and who pulled it in. Big projects often have three or four different versions of the same package. Check each one.
Step 02: Query one version
curl -d '{"package":{"name":"minimatch","ecosystem":"npm"},"version":"3.0.4"}' https://api.osv.dev/v1/query
On Windows PowerShell, use curl.exe and put the JSON in a file (-d @q.json) to avoid quote mangling. Ecosystem names are case-sensitive: npm, PyPI, crates.io, Go, Maven.
Step 03: Read the answer
Each item in vulns gives you:
id: the advisory id, for exampleGHSA-3ppc-4f35-3m26aliases: the CVE, hereCVE-2026-26996summary: one line, here "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern"database_specific.severity:HIGH, pluscwe_ids(CWE-1333 is ReDoS)affected[].ranges[].events: pairs likeintroduced 0, fixed 3.1.4. Thefixedvalue is your upgrade target.
An empty {} means no known advisories for that version. That is the answer you want.
Step 04: Check many at once
curl -d '{"queries":[
{"package":{"name":"minimatch","ecosystem":"npm"},"version":"3.0.4"},
{"package":{"name":"axios","ecosystem":"npm"},"version":"1.6.0"},
{"package":{"name":"lodash","ecosystem":"npm"},"version":"4.17.21"}]}' https://api.osv.dev/v1/querybatch
querybatch returns only ids, in the order you sent the queries. That is how we got 4, 31 and 3 above. Pull the full record for any id with curl https://api.osv.dev/v1/vulns/GHSA-3ppc-4f35-3m26.
GitHub Advisory Database, Tensorust count for our npm advisories article. October covers the 1st to the 23rd.
Step 05: Scan the whole lockfile
Install osv-scanner (release binary, or go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest), then:
osv-scanner -L package-lock.json
It reads every pinned dependency, deep ones included, and prints a table of package, version and advisory id. It also reads Cargo.lock, requirements.txt, poetry.lock, go.mod and more. For Rust specifically, cargo audit is the native tool.
Step 06: Put it in CI
Run the scanner on every pull request that touches a lockfile. Google publishes a ready-made osv-scanner GitHub Action. A failing build is the only alert people do not ignore.
What goes wrong
- Wrong ecosystem string.
PyPiorNPMreturns nothing, which looks like "safe". Copy the exact names from the OSV schema. - Querying the range, not the version. The API wants
3.0.4, not^3.0.4. - Assuming one copy. You fixed the top-level minimatch; a build tool three levels down still ships 3.0.4. Use
overridesin package.json and re-runnpm ls. - Reading count as risk. 31 advisories on axios 1.6.0 does not mean 31 are exploitable in your app. Read the summary and check whether you call the affected function.
What to do next
Run Step 4 on your ten biggest dependencies today. Anything with a high-severity advisory and a fixed version gets upgraded this week. Then wire Step 6 in so it never piles up again. If you depend on a company's software rather than a package, our Company Watch monitors the filings and contracts side the same way.
Related
- The npm advisories breakdown: who got hit in 2026 and who still installs it
- What is ReDoS? Regex denial of service with real timings
- How to check Cargo.lock with cargo audit
- What is IDOR?
FAQ
How do I check if an npm package version has vulnerabilities?
POST the package name, ecosystem npm and the version to https://api.osv.dev/v1/query. The response lists every known advisory affecting that exact version. npm audit does the same for your whole lockfile using the GitHub Advisory Database.
Is the OSV API free?
Yes. OSV.dev is run by Google's open source security team, needs no API key, and covers npm, PyPI, crates.io, Go, Maven, NuGet, RubyGems, Packagist and more.
What is the difference between OSV, GHSA and CVE ids?
CVE is the global id from MITRE's program. GHSA ids come from the GitHub Advisory Database. OSV is a shared format and database that aggregates GHSA, PyPI, RustSec, Go and others, and lists the CVE in aliases.
What does querybatch return?
Only the advisory ids for each query, in the same order you sent them, to keep responses small. Fetch the full record for any id with GET https://api.osv.dev/v1/vulns/<id>.
How do I scan a whole project?
Use osv-scanner, the official CLI: osv-scanner -L package-lock.json checks every pinned dependency. For Rust, cargo audit does the same against RustSec.
Sources
All checked October 27, 2026.
- OSV.dev, API overview, POST /v1/query, POST /v1/querybatch.
- OSV live answers: minimatch 3.0.4, brace-expansion 1.1.11, axios 1.6.0, lodash 4.17.21 (queried Oct 27 2026).
- GitHub Advisory Database, GHSA-3ppc-4f35-3m26 (CVE-2026-26996).
- OpenSSF, OSV schema.
- Google, osv-scanner and its GitHub Action.
- Tensorust, npm advisories article and data.csv.
- Images: cards and charts by Tensorust.
Do this next
Every number on this page links to its source and was checked on Oct 27, 2026. Spot an error or a newer figure? Email matt@tensorust.com and it gets fixed.
Read next
- Article · Oct 24, 2026OpenClaw got 591 advisories. 1 in 4 top npm installs is the real hole
- Guide · Oct 27, 2026How to look up your car's recalls by VIN in the NHTSA database
- Guide · Oct 27, 2026How to search USAspending.gov for any company's federal contracts (and catch the resellers)
Get the next one by email.
What my AI agents tried this week, with the real numbers: what worked, what flopped, what made money. One email when there is something worth reading.
No spam, never sold. Every email has a one-click unsubscribe.
.jpg){kind=link}