P0 Package Risk & Vulnerability Lookup

{
  "type": "json",
  "example": {
    "name": "lodash",
    "note": "Records OSV.dev holds for exactly this package version, as OSV matches them; different databases may describe the same issue (aliases) so record_count can exceed distinct_cves. severity is the source's own label (GitHub records only); no number is computed. No record is not proof of safety: OSV only lists disclosed issues. Package existence is confirmed by the records themselves or, when there are none, by the package registry (package_verified). scorecard: OpenSSF Scorecard of the whole source repo named by the registry entry, as of its scan date; null with scorecard_reason when none is named, covered or scanned.",
    "as_of": "2026-10-25T09:00:00.000Z",
    "source": "OSV.dev",
    "version": "4.17.15",
    "returned": 2,
    "ecosystem": "npm",
    "scorecard": {
      "date": "2026-10-20T07:35:09Z",
      "repo": "github.com/lodash/lodash",
      "score": 6.6,
      "checks": [
        {
          "name": "Code-Review",
          "score": 7,
          "reason": "Found 22/30 approved changesets -- score normalized to 7"
        }
      ],
      "source": "OpenSSF Scorecard",
      "repo_from": "npm registry: repository",
      "source_url": "https://api.scorecard.dev/projects/github.com/lodash/lodash",
      "attribution": "OpenSSF Scorecard (https://scorecard.dev), licensed CDLA Permissive 2.0 (https://cdla.dev/permissive-2-0/); check reasons shortened by P0.",
      "scorecard_version": "v5.5.0"
    },
    "truncated": false,
    "source_url": "https://osv.dev/list?ecosystem=npm&q=lodash",
    "vulnerable": true,
    "attribution": "Vulnerability records from OSV.dev (https://osv.dev), aggregated from the GitHub Advisory Database (CC-BY 4.0), PyPI Advisory Database (CC-BY 4.0), Go Vulnerability Database (CC-BY 4.0), RustSec (CC0 1.0), OSS-Fuzz (CC-BY 4.0), OpenSSF Malicious Packages (Apache 2.0), Global Security Database (CC0 1.0) and NVD (public domain). Each record names its source and licence; titles are shortened and reformatted by P0. Records under share-alike or non-commercial licences (Ubuntu, Alpine, Chainguard/Wolfi) and records of unverified origin are not included.",
    "by_severity": {
      "HIGH": 1,
      "MODERATE": 1
    },
    "max_severity": "HIGH",
    "record_count": 2,
    "distinct_cves": 2,
    "vulnerabilities": [
      {
        "id": "GHSA-35jh-r3h4-6jhm",
        "cwe": [
          "CWE-77"
        ],
        "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm",
        "source": "GitHub Advisory Database",
        "aliases": [
          "CVE-2021-23337"
        ],
        "license": "CC-BY-4.0",
        "summary": "Command Injection in lodash",
        "fixed_in": [
          "4.17.21"
        ],
        "modified": "2026-03-05T20:39:45Z",
        "severity": "HIGH",
        "malicious": false,
        "published": "2021-05-06T16:05:51Z",
        "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
      }
    ],
    "package_verified": "OSV.dev records for this exact version",
    "scorecard_reason": null,
    "malicious_reports": 0,
    "excluded_for_licence": 0
  }
}