Social Fetch
Start for freeStart free
npm hub

npm Advisories API

Security advisories for one version, the latest, or every published version, with severity, CWE ids and CVSS in one list.

GET /v1/npm/package/advisories

1 credit Failed requests are free

Try in playgroundFull API docs

About this endpoint

GET /v1/npm/package/advisories?name=lodash&version=4.17.15 returns data.advisories, each with id, url, title, severity, vulnerableVersions, cwe and cvss.score plus cvss.vectorString. data.versions lists the versions that were checked, with a dist-tag replaced by the version it points to.

version accepts an exact version, a dist-tag, all for every version the package publishes, or is omitted for latest. A dist-tag is resolved to the version it points to. Semver ranges are not resolved. A clean package returns data.advisories: [] with lookupStatus: found. An unknown package or version is not_found.

npm Advisories API FAQ

How do I check every version of a package?

Pass version=all to check every published version. Expect a larger answer and a longer lookup for packages with many releases.

What is the default version?

Omitting version is the same as version=latest. The latest version number is resolved first, then its advisories are checked. Pass an exact version or a dist-tag to choose another version.

What do severity and CVSS mean?

severity is npm's label: low, moderate, high or critical. cvss.score and cvss.vectorString come from the advisory and may be null when the advisory has no CVSS entry. cwe holds CWE ids.

How does the route tell an unknown package from a clean one?

An explicit version or dist-tag that does not exist returns not_found. A version that exists with no advisories is found with an empty list, so an unknown package or version is never reported as clean.

What does the request cost?

Pricing is documented on the operation in the API registry (shown on this page). Confirm on every response with meta.creditsCharged: that field is the billing source of truth.

Other npm endpoints