Check what you actually ship

Why this is not the search box

Free-text search matches words in advisory text. That is the wrong shape of question for installed software, in three ways that better ranking would not fix. It has no ecosystem, so the npm package zip and the crates.io crate zip look like the same thing when they are unrelated software by unrelated authors. It has no versions, so 4.17.15 and 4.17.21 are indistinguishable when only one of them is vulnerable. And it only knows the advisories in this feed’s window, where a dependency check needs every advisory ever published against that package.

This resolves coordinates instead — an ecosystem, a name, a version — through OSV.dev, the database the ecosystems themselves publish into and which records affected version ranges.

And why not just npm audit

npm audit tells you which advisories apply. It cannot tell you which of them anyone could act on, so it sorts by a severity label and leaves you forty rows that all look equally urgent. Every finding here also carries whether exploit code exists and how reachable it is — a Metasploit module, an archived Exploit-DB entry, published proof-of-concept code, a Nuclei template — and the list is ordered by that first.

Which reorders the work: a moderate with a working module is a worse afternoon than a critical nobody has written anything for. Patch first at the top of the result is that ordering, with the version to upgrade to.

Formats it reads

• package.json npm ranges only
• package-lock.json npm
• npm-shrinkwrap.json npm
• yarn.lock npm
• requirements.txt PyPI
• poetry.lock PyPI
• Pipfile.lock PyPI
• go.mod Go
• Cargo.lock crates.io
• Gemfile.lock RubyGems
• composer.lock Packagist

A lockfile is much better than a manifest. A lockfile states the version that is installed; package.json states a range, which has to be coerced to its lowest version to be queryable at all — so findings from one are flagged as approximate.

From a script, or an agent

The same check over HTTP, with no key:

curl -X POST https://cve.zerocrew.in/api/dependencies/check \
  -H 'Content-Type: application/json' \
  --data "{\"manifest\": $(jq -Rs . < package-lock.json)}"

Or as a tool your agent can call itself — check_dependencies over MCP, which parses the lockfile for you.