Skip to content
OpenAdvisories

Dependency scan

Scan a lockfile

Upload or paste a lockfile. Every pinned dependency is checked against known vulnerabilities and malicious-package reports. The file is processed in memory and not stored.

No file chosen — or paste below

Supported files

  • package-lock.json · npm
  • yarn.lock · npm
  • pnpm-lock.yaml · npm
  • requirements.txt · PyPI
  • poetry.lock · PyPI
  • uv.lock · PyPI
  • Pipfile.lock · PyPI
  • composer.lock · Packagist
  • Gemfile.lock · RubyGems
  • go.mod · Go
  • Cargo.lock · crates.io
  • packages.lock.json · NuGet
  • gradle.lockfile · Maven

Only exact versions are checked (lockfiles, or == pins in requirements.txt).

Use it from CI

POST the file; fail the build when vulnerable is true.

curl -s --data-binary @package-lock.json \
  "https://www.openadvisories.org/api/scan?filename=package-lock.json" \
  | jq -e '.vulnerable | not'