Check your dependencies
Drop files here or choose files
requirements.txt · package-lock.json · Dockerfile (up to 10 files, 5 MB each)
Your files never leave your browser. We read them on your device and send only package names and version numbers to OSV.dev, the open vulnerability database launched by Google.6 If your browser blocks that, the same list passes through our server without being stored. Values in your Dockerfile are never sent anywhere.
What it checks
- Known vulnerabilities in the exact versions listed in your files, from OSV.dev, which combines the GitHub Advisory Database, the PyPI Advisory Database and other sources.1
- Malicious packages: versions reported as malware by the OpenSSF Malicious Packages project, one of OSV.dev's sources.1,2
- Dockerfile risks: base images without a fixed version, packages installed without exact versions, and possible secrets placed in
ENVorARG, which stay readable in the image.3,4 - A rotate-secrets checklist for when a malicious or compromised package has run on your machines.5
What it does not check
- Version ranges (for example
>=2.0) andpackage.json: only exact versions can be matched. Upload your lockfile for full results. - Operating-system packages inside container images, and the base image's own contents.
- Your own code, or problems nobody has reported yet. "No known issues" is not a guarantee.
- Other ecosystems (Maven, Go, Rust, Ruby, PHP Composer). Tell us if you need them.
Need this across every repository and pipeline, with alerts when new advisories land? Talk to us.