Drop a lockfile here, or
composer.lock, package-lock.json, npm-shrinkwrap.json, yarn.lock or pnpm-lock.yaml
The file is read in your browser and never uploaded to our server. Only package names, versions and the ecosystem go to OSV.dev. This is a quick check, not a replacement for a full scanner.
OSV.dev has no advisory for these exact versions today. That does not prove the project is safe.
How it works
- Your browser reads the lockfile and lists each package with its exact version. The file is never uploaded to our server.
- Only the package names, versions and ecosystem (Packagist or npm) go to the free OSV.dev API, in batches of up to 1,000.
- For each advisory found, the page gets the summary, severity and fixed versions from OSV.dev, and groups the results by severity.
- This is a quick check, not a full audit. It finds known advisories for exact versions. It does not read your code or find new problems.
FAQ
Frequently asked questions
Is my lockfile uploaded?
No. The file is read by JavaScript in your browser. Only package names, versions and the ecosystem go to api.osv.dev. Nothing goes to our server.
Which lockfiles work?
composer.lock, package-lock.json (versions 1, 2 and 3), npm-shrinkwrap.json, yarn.lock (Yarn classic and Berry) and pnpm-lock.yaml (lockfile version 6 and later). bun.lock is not supported yet.
Does a clean result mean my project is safe?
No. It means OSV.dev has no advisory for those exact versions today. Use a full scanner in CI, and check again when new advisories come out.
Where do the severities come from?
From the advisory in OSV.dev. Most come from the GitHub Advisory Database. Advisories with no rating show as Unknown.
Why are some packages skipped?
Packages without an exact version, such as dev-main branches in Composer or local links in npm, cannot be matched to an advisory. The page tells you how many it skipped.
DevWorkspace Pro
One workspace for every project
Files, Git, GitHub, AI agents, the terminal and your runtimes in one desktop app. Works with every project folder.