Is my package.json sent to any server?

Your package.json is parsed entirely in your browser. Only individual package names and version numbers are sent to the public OSV.dev API to check for vulnerabilities. No other data from your file is transmitted.

What data sources does Package Audit use?

Package Audit queries the OSV (Open Source Vulnerabilities) database at osv.dev, which aggregates vulnerability data from GitHub Security Advisories (GHSA), npm audit advisories, and the National Vulnerability Database (NVD).

Does this tool support lockfiles (package-lock.json)?

Currently, Package Audit only supports package.json files. This means it checks declared version ranges rather than exact resolved versions. For lockfile-based scanning, use npm audit or OSV-Scanner.

What do the severity levels mean?

Critical means exploitable with significant impact. High is a serious vulnerability but harder to exploit. Moderate has limited impact. Low is a minor issue. Unrated means the vulnerability exists but severity has not been assessed.

How accurate are the version checks?

The tool strips semver range prefixes (^, ~, >=) and queries the OSV database with the declared version. For exact resolved version checking, use a lockfile-based scanner like npm audit or OSV-Scanner.

Security & Auth

Package Audit

Free online npm vulnerability scanner. Upload your package.json and instantly check for known security vulnerabilities using the OSV database. 100% client-side — your file is parsed in your browser.

Open tool

Quick reference

Category: Security & Auth
Runs in: Browser
Data stored: Nothing
Price: Free
Sign-up: Not needed

Browse categories

All features

Scan via OSV and GitHub Advisory databases
Health checks: outdated, deprecated, copyleft, abandoned
Supply-chain script analysis (install hooks, exfiltration)
Severity classification: Critical to Unrated
Include or exclude devDependencies
Sortable, filterable results with CVE/GHSA links
Export as JSON, SARIF, or Markdown
Suggested fix versions with copyable npm install command

What you can do

Scan your dependencies

Upload your package.json and the tool checks every dependency against the OSV and GitHub Advisory databases for known CVEs and GHSAs.

Check package health

See which packages are outdated, deprecated, abandoned, or have a single maintainer. Review licenses including copyleft detection at a glance.

Detect supply-chain script risks

Static analysis of npm lifecycle scripts (postinstall, preinstall) and commands for network exfiltration, env access, code execution, and obfuscation patterns.

Generate fix commands

Get a copyable npm install command with suggested fix versions for every vulnerable or outdated package, ready to paste into your terminal.

Export for CI/CD

Download results as SARIF for GitHub Code Scanning, JSON for programmatic processing, or Markdown for pull request comments.

Private by design

Client-side
No sign-up
Free

Package Audit runs entirely in your browser tab. No data is uploaded, no server processes your input, and no account is required.

Specifications

Databases: OSV (osv.dev) + GitHub Advisory (EPSS, CWE)
Health checks: Outdated, deprecated, abandoned, copyleft, maintainers
Script analysis: Network exfil, env access, code exec, obfuscation, install hooks
Input: package.json (drag-drop, paste, sample)
Severity levels: Critical, High, Moderate, Low, Unrated
Export formats: JSON, SARIF (GitHub Code Scanning), Markdown
Ecosystem: npm (Node.js)
File parsing: 100% client-side