Package Audit - npm Vulnerability Scanner

Scan your package.json for known vulnerabilities using the OSV database. Free, instant, no signup required. Vulnerability data is fetched via our server; no data is stored.

Features

• Scan package.json dependencies against the OSV database
• Direct and transitive vulnerability detection
• Severity ratings (low / medium / high / critical)
• CVE and advisory links
• Fixed-version recommendations
• No data stored

Frequently Asked Questions

What is the OSV database?

OSV (Open Source Vulnerabilities) is an open, distributed database of vulnerabilities in open-source software, including the data behind GitHub Security Advisories and many ecosystems. It is the modern successor to the National Vulnerability Database feeds.

How do I fix a flagged vulnerability?

Upgrade to a fixed version listed in the advisory. For direct dependencies, bump the version in package.json. For transitive dependencies, use npm override (package.json “overrides”) or npm audit fix, then re-scan to confirm.

Is my package.json uploaded?

The dependency names and versions are sent to the OSV API to look up known vulnerabilities. No source code, private keys, or registry tokens should ever be in a package.json. If they are, remove them first.