Legacy npm Vulnerabilities API

The original npm endpoint remains available for existing integrations. New integrations should use Package Vulnerability Intelligence, which adds exact-version checks, CVE-to-CISA KEV evidence, pagination, and a consistent response across npm, Composer, PyPI, Maven, and Go.

Endpoint

GET /vulnerabilities/npm/{package}/

An active workspace API key is required. This endpoint is included in Free and consumes one shared monthly lookup unit per request. See Authorization.

The {package} path parameter supports scoped names such as @babel/core. URL-encode path segments as needed:

curl "https://api.requestguard.com/v1/vulnerabilities/npm/express/" \
  -H "Authorization: Bearer rg_sk_live_..."
curl "https://api.requestguard.com/v1/vulnerabilities/npm/%40babel%2Fcore/" \
  -H "Authorization: Bearer rg_sk_live_..."

Response

{
  "package": {
    "name": "express",
    "ecosystem": "npm",
    "latestVersion": "5.1.0",
    "description": "Fast, unopinionated, minimalist web framework",
    "license": "MIT",
    "repositoryUrl": "https://github.com/expressjs/express"
  },
  "downloads": {
    "weeklyDownloads": 104192101,
    "start": "2026-05-10",
    "end": "2026-05-16"
  },
  "summary": {
    "total": 0,
    "highest": "none",
    "counts": {
      "critical": 0,
      "high": 0,
      "moderate": 0,
      "low": 0,
      "unknown": 0
    }
  },
  "advisories": [],
  "sources": {
    "npm": "https://registry.npmjs.org/{package}",
    "downloads": "https://api.npmjs.org/downloads/point/last-week/{package}",
    "osv": "https://api.osv.dev/v1/query"
  },
  "checkedAt": "2026-05-17T12:00:00.000Z",
  "noAdvisoryCopy": "No known OSV advisories found for this npm package. This is not a security guarantee; continue to monitor updates and audit your dependency graph."
}

Errors

404 means the package was not found in the npm registry.

503 means the npm registry, npm downloads API, or OSV upstream is unavailable.

This compatibility response is not expanded with the fields from the multi-ecosystem endpoint. Use GET /vulnerabilities/packages/npm/{coordinate}/ when you need the current response model.