---
title: "Package Vulnerabilities: Known CVEs for npm and PyPI Versions"
method: GET
path: "/v1/package-vulnerabilities"
tags: ["vulnerability"]
---

# Package Vulnerabilities: Known CVEs for npm and PyPI Versions

`GET /v1/package-vulnerabilities`

## Request

- Base URL: `https://api.ambolt.dev`
- URL: `https://api.ambolt.dev/v1/package-vulnerabilities`
- Auth: none required

Check an npm or PyPI package version against a public vulnerability database: advisory ids, aliases (CVE, GHSA), summary, severity label and first fixed version, plus the latest published version. Informational; not a full security audit.

## Query parameters

- `ecosystem` 'npm' | 'PyPI', required: Package ecosystem.
- `name` string, required: Package name, e.g. lodash or requests.
- `version` string: Version to check. Default: latest published version.
- `free` '1'

## Response `200`

Result (JSON). Every result names its source and the time it was read.

- object

## Other responses

- `400`: Invalid input; not charged.
- `402`: Payment required: 0.003 USD in USDC (x402 v2).

---

[API](https://skmtc.dev/ambolt/apis/ambolt-data-tools.md) · [All operations](https://skmtc.dev/ambolt/apis/ambolt-data-tools/llms.txt) · [OpenAPI document](https://skmtc.dev/ambolt/apis/ambolt-data-tools/revisions/8397885dd82f?raw)