> **For coding agents and LLMs:** This is one Social Fetch marketing page (markdown export). For API orientation start with [`/llms.txt`](https://www.socialfetch.dev/llms.txt); for auth and crawl rules use [`/agents.txt`](https://www.socialfetch.dev/agents.txt); for every operation use [`/llms-endpoints.txt`](https://www.socialfetch.dev/llms-endpoints.txt).

## This page

- **On-site (HTML):** <https://www.socialfetch.dev/platforms/npm/package-advisories>
- **Markdown (.mdx) URL:** <https://www.socialfetch.dev/platforms/npm/package-advisories.mdx>

---

# npm Advisories API

Security advisories for one version, the latest, or every published version, with severity, CWE ids and CVSS in one list.

`GET /v1/npm/package/advisories?name=lodash&version=4.17.15` returns `data.advisories`, each with `id`, `url`, `title`, `severity`, `vulnerableVersions`, `cwe` and `cvss.score` plus `cvss.vectorString`. `data.versions` lists the versions that were checked, with a dist-tag replaced by the version it points to.

`version` accepts an exact version, a dist-tag, `all` for every version the package publishes, or is omitted for `latest`. A dist-tag is resolved to the version it points to. Semver ranges are not resolved. A clean package returns `data.advisories: []` with `lookupStatus: found`. An unknown package or version is `not_found`.

## Request

- **Endpoint:** `GET /v1/npm/package/advisories`
- **Credits:** 1 credit
Failed requests are free
- **Input:** by package name and version
- **Full reference:** [docs](https://www.socialfetch.dev/docs/api/v1/npm/package/advisories/get)
- **Platform page:** [/platforms/npm](https://www.socialfetch.dev/platforms/npm)

## FAQ

### How do I check every version of a package?

Pass version=all to check every published version. Expect a larger answer and a longer lookup for packages with many releases.

### What is the default version?

Omitting version is the same as version=latest. The latest version number is resolved first, then its advisories are checked. Pass an exact version or a dist-tag to choose another version.

### What do severity and CVSS mean?

severity is npm's label: low, moderate, high or critical. cvss.score and cvss.vectorString come from the advisory and may be null when the advisory has no CVSS entry. cwe holds CWE ids.

### How does the route tell an unknown package from a clean one?

An explicit version or dist-tag that does not exist returns not_found. A version that exists with no advisories is found with an empty list, so an unknown package or version is never reported as clean.

### What does the request cost?

Pricing is documented on the operation in the API registry (shown on this page). Confirm on every response with meta.creditsCharged: that field is the billing source of truth.