Package Vulnerability Intelligence

RequestGuard combines registry metadata with published OSV records for five package ecosystems. Composer results also include Packagist security advisories. When an advisory has a CVE identifier, RequestGuard checks for an exact match in the CISA Known Exploited Vulnerabilities catalog.

Package vulnerability evidence is separate from the RequestGuard fraud score. A missing advisory is not proof that a package or deployment has no vulnerability.

Endpoint

GET /vulnerabilities/packages/{ecosystem}/{coordinate}/

An active workspace API key is required. This endpoint is included in Free and consumes one shared monthly lookup unit per request. See Authorization. Supported ecosystem values are npm, composer, pypi, maven, and go.

curl "https://api.requestguard.com/v1/vulnerabilities/packages/npm/express/" \
  -H "Authorization: Bearer rg_sk_live_..."
curl "https://api.requestguard.com/v1/vulnerabilities/packages/composer/symfony%2Fhttp-kernel/" \
  -H "Authorization: Bearer rg_sk_live_..."
curl "https://api.requestguard.com/v1/vulnerabilities/packages/pypi/django/" \
  -H "Authorization: Bearer rg_sk_live_..."
curl "https://api.requestguard.com/v1/vulnerabilities/packages/maven/org.apache.logging.log4j%3Alog4j-core/" \
  -H "Authorization: Bearer rg_sk_live_..."
curl "https://api.requestguard.com/v1/vulnerabilities/packages/go/golang.org%2Fx%2Fcrypto/" \
  -H "Authorization: Bearer rg_sk_live_..."

The website also accepts readable slash-delimited package routes, such as /vulnerabilities/composer/symfony/http-kernel/.

Exact Version Check

Pass the registry’s exact version string in version:

curl "https://api.requestguard.com/v1/vulnerabilities/packages/npm/lodash/?version=4.17.20" \
  -H "Authorization: Bearer rg_sk_live_..."

The response distinguishes four states:

versionCheck.status	Meaning
affected	OSV returned at least one active advisory for the exact version.
no_known_advisory	OSV returned no active advisory for the exact version.
not_evaluated	A source record could not be evaluated against the version.
unavailable	The exact-version lookup did not complete.

knownExploitation is joined only through an exact CVE identifier. RequestGuard does not infer a package match from CISA vendor or product text.

Pagination

Use limit from 1 to 500 and a non-negative offset. The default limit is 100. pagination.available reports the number of retained active advisories before pagination.

Source Status

Each item in sources identifies the registry, advisory database, or catalog used for the lookup. A status can be fresh, stale, or unavailable. _meta.partial is true when one source did not complete the lookup; available evidence is still returned.

Errors

• 400 means the ecosystem, coordinate, version, or pagination input is invalid.
• 404 means the registry did not return the package or selected version.
• 503 means the package registry is unavailable. Advisory-source failures produce a partial 200 response when registry metadata remains available.