Know your dependencies.Trust what you ship.

Search any npm package for real security advisories, weekly downloads, and OpenSSF Scorecards — or audit your whole lockfile at once.

Real advisories

Vulnerabilities come straight from OSV.dev — the open database aggregating GitHub Security Advisories and CVEs.

Honest scoring

Security scores are derived from known advisories, publish recency, and the repo's OpenSSF Scorecard — never invented.

Lockfile audit

Drop in a package-lock.json and get every dependency checked against the OSV database in one pass.

Popular packages

Curated selection — live registry & OSV data

react

v19.2.8

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

React is a JavaScript library for building user interfaces.

161.7MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v19.2.8 (the latest release), from the OSV.dev database.

next

v16.2.12

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

The React Framework

54.9MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v16.2.12 (the latest release), from the OSV.dev database.

typescript

v7.0.2

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

TypeScript is a language for application scale JavaScript development

254.7MDownloads across all versions in the last 7 days, from the official npm downloads API.Apache-2.0License declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v7.0.2 (the latest release), from the OSV.dev database.

express

v5.2.1

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Fast, unopinionated, minimalist web framework

126.8MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v5.2.1 (the latest release), from the OSV.dev database.

vite

v8.2.0

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Native-ESM powered web dev build tool

144.3MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v8.2.0 (the latest release), from the OSV.dev database.

axios

v1.19.0

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Promise based HTTP client for the browser and node.js

110.7MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v1.19.0 (the latest release), from the OSV.dev database.

zod

v4.4.3

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

TypeScript-first schema declaration and validation library with static type inference

247.7MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v4.4.3 (the latest release), from the OSV.dev database.

tailwindcss

v4.3.3

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

A utility-first CSS framework for rapidly building custom user interfaces.

117.2MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v4.3.3 (the latest release), from the OSV.dev database.

eslint

v10.8.0

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

An AST-based pattern checker for JavaScript.

153.0MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v10.8.0 (the latest release), from the OSV.dev database.

prettier

v3.9.6

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Prettier is an opinionated code formatter

117.4MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v3.9.6 (the latest release), from the OSV.dev database.

jest

v30.4.2

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Delightful JavaScript Testing.

46.4MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v30.4.2 (the latest release), from the OSV.dev database.

vitest

v4.1.10

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Next generation testing framework powered by Vite

86.3MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v4.1.10 (the latest release), from the OSV.dev database.

lodash

v4.18.1

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Lodash modular utilities.

164.9MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v4.18.1 (the latest release), from the OSV.dev database.

date-fns

v4.4.0

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Modern JavaScript date utility library

95.4MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v4.4.0 (the latest release), from the OSV.dev database.

commander

v15.0.0

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

the complete solution for node.js command-line programs

471.4MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v15.0.0 (the latest release), from the OSV.dev database.

chalk

v6.0.0

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Terminal string styling done right

455.2MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v6.0.0 (the latest release), from the OSV.dev database.

dotenv

v17.4.2

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Loads environment variables from .env file

152.8MDownloads across all versions in the last 7 days, from the official npm downloads API.BSD-2-ClauseLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v17.4.2 (the latest release), from the OSV.dev database.

pino

v10.3.1

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

super fast, all natural json logger

41.8MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v10.3.1 (the latest release), from the OSV.dev database.

fastify

v5.11.0

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Fast and low overhead web framework, for Node.js

10.6MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v5.11.0 (the latest release), from the OSV.dev database.

@expressots/core

v4.1.1

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Expressots - modern, fast, lightweight nodejs web framework (@core)

—Downloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v4.1.1 (the latest release), from the OSV.dev database.

mongoose

v9.9.1

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Mongoose MongoDB ODM

6.2MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v9.9.1 (the latest release), from the OSV.dev database.

prisma

v7.9.1

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Prisma is an open-source database toolkit. It includes a JavaScript/TypeScript ORM for Node.js, migrations and a modern GUI to view and edit the data in your database. You can use Prisma in new projects or add it to an existing one.

15.5MDownloads across all versions in the last 7 days, from the official npm downloads API.Apache-2.0License declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v7.9.1 (the latest release), from the OSV.dev database.

drizzle-orm

v0.45.2

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Drizzle ORM package for SQL databases

17.6MDownloads across all versions in the last 7 days, from the official npm downloads API.Apache-2.0License declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v0.45.2 (the latest release), from the OSV.dev database.

hono

v4.12.33

100
0-100 score computed by this site from verifiable signals only: known OSV.dev advisories affecting this exact version, how recently it was published, and the repository's OpenSSF Scorecard.

Web framework built on Web Standards

54.3MDownloads across all versions in the last 7 days, from the official npm downloads API.MITLicense declared in the package manifest.

No known vulnerabilities

Known vulnerabilities affecting v4.12.33 (the latest release), from the OSV.dev database.