Is your app affected by a known vulnerability?
Paste your lockfile. We check every package version against the same feeds as our vulnerability list, and put what attackers are exploiting right now at the top.
Read in your browser, checked in memory, never stored or logged. Only package names and versions go to OSV.
What it reads
package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock, package.json, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, composer.lock, go.sum, go.mod, Gemfile.lock and Cargo.lock, up to 2 MB. Your file isn't stored or logged; package names and versions are sent to OSV (osv.dev) to look up advisories.