List npm package security advisories
List the security advisories affecting an npm package version, or every version.
Headers
Get your API keyAPI key (`sfk_...`)
npm package name, e.g. `express`, `lodash.merge`, `@types/node` or `--file--1`. Names are case-sensitive (`Express` is a different package) and keep legacy punctuation such as a leading `-`.
max 214 chars
Exact version or dist-tag to check, `all` for every version, or omit for `latest`. A dist-tag is resolved to the version it points to. Semver ranges are not resolved.
Endpoint-specific response payload.
Whether the item exists. Every outcome is HTTP 200; branch on this field.
one of: found, not_found
Package name.
Versions that were checked, in the order the package lists them. A dist-tag is replaced by the version it points to.
Advisories affecting those versions. An unknown name is `not_found`; a package with no advisories is `found` with `[]`.
GitHub advisory id.
GitHub advisory URL.
Advisory title.
Severity.
one of: low, moderate, high, critical
Semver range of affected versions, as npm reports it.
CWE ids.
CVSS score and vector.
CVSS score.
CVSS vector.
Metadata describing the request and billing outcome.
Unique request identifier for tracing this API call.
min 1 chars
Credits charged for this request.
≥ 0
Public API version that served the response.
one of: v1
Code example
curl "https://api.socialfetch.dev/v1/npm/package/advisories?name=lodash" \
-H "x-api-key: YOUR_API_KEY"Responses
npm advisories.