Security and provenance for an open-source package...
Security and provenance for an open-source package, composed live from three authoritative sources in one call. Pass ecosystem (npm, pypi, go, maven, cargo, nuget) + name (+ optional version; defaults to latest). Returns: known vulnerabilities from OSV (osv.dev — aggregates GitHub Security Advisories, PyPA, RustSec, Go vuln DB, etc.) each with its id, CVE aliases, summary, severity, and references; the resolved license and deprecation status (deps.dev); and the source repo's OpenSSF Scorecard health score (overall + per-check) plus stars/forks/open-issues. All live — newly-disclosed advisories appear within hours. Distinct from registry.npm-lookup / pypi-lookup (metadata only): this answers "is this dependency safe to add, what license does it carry, and how well-maintained is it."
Request
- Base URL: https://2s.io
- URL: https://2s.io/api/security/package
- Auth: API key in header PAYMENT-SIGNATURE
Query parameters
Package ecosystem: npm, pypi, go, maven, cargo, or nuget.
Package name (e.g. lodash, requests, github.com/gin-gonic/gin).
Specific version (defaults to the latest/default version).
Try before you buy. Set to 1 for one free real call per endpoint per hour — no wallet or payment needed — to verify the endpoint before paying. Equivalent to sending the "X-2s-Trial: 1" request header. Listed only on operations that offer a trial; the others always answer 402.
Response
Changes
No recorded changes to this operation across all 1 revision of this API.