Dependency Vulnerability Scanner

← Data & Config Processed on the server

OSV mirror: 283,713 advisories across 7 ecosystems · refreshed 2026-09-12 04:00 UTC

Drop lockfile to load

Format Choose file

Scan from the command line (API)

POST a lockfile as JSON to /deps/scan — no key, no account. Matching runs against the same local OSV mirror, so your dependency list is never passed on to a third party.

curl -s https://1234.nu/deps/scan \
  -H 'Content-Type: application/json' \
  -d '{"content": "<lockfile text>", "format": "auto"}'

Returns { ok, format, scanned, vulnerablePackages, summary, findings[], dbBuiltAt }, or { ok: false, error } on bad input. format takes auto or any format id from the dropdown. GET /deps/status reports the mirror's built state and last refresh time.

Matching is exact for SemVer ecosystems (npm, crates.io, Go, Packagist). For PyPI, RubyGems and Maven, versions with unusual pre/post-release suffixes that can't be ordered with confidence are flagged "verify" rather than dismissed — so a real risk is never hidden. Data from OSV.dev (advisories carry their own source licenses, e.g. the GitHub Advisory Database under CC BY 4.0).