{
"scope": "SupplyChain Scan joins two public sources at query time: vulnerability records from OSV (Google's Open Source Vulnerabilities database), matched to the exact package and version, and package records from the npm registry. A dependency with no listed vulnerabilities has no record in OSV for that exact version at query time - that is not a guarantee of safety, and results change as OSV updates. Severity is OSV's rating (CRITICAL / HIGH / MODERATE / LOW), reported with the CVSS vector; no runtime or reachability analysis is performed - whether the vulnerable code path is ever called is not checked. Private registries are not scanned.",
"results": [
{
"name": "lodash",
"version": "4.17.20",
"errors": [],
"package": {
"latestVersion": "4.18.1",
"versionCount": 117,
"license": "MIT",
"modified": "2026-11-09T00:39:03.555Z",
"deprecated": null
},
"vulnerable": true,
"vulnCount": 4,
"vulnTotal": 4,
"vulnReturned": 4,
"truncated": false,
"highestRating": "HIGH",
"vulns": [
{
"id": "GHSA-29mw-wpgm-hmr9",
"aliases": [
"CVE-2020-28500"
],
"summary": "Regular Expression Denial of Service (ReDoS) in lodash",
"rating": "MODERATE",
"ratingSource": "osv",
"cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"fixedVersions": [
"4.17.21"
],
"published": "2022-01-06T20:30:46Z",
"modified": "2025-09-29T21:12:31.102523Z"
},
{
"id": "GHSA-35jh-r3h4-6jhm",
"aliases": [
"CVE-2021-23337"
],
"summary": "Command Injection in lodash",
"rating": "HIGH",
"ratingSource": "osv",
"cvss": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"fixedVersions": [
"4.17.21"
],
"published": "2021-05-06T16:05:51Z",
"modified": "2026-10-17T02:55:38.085813876Z"
},
{
"id": "GHSA-r5fr-rjxr-66jc",
"aliases": [
"CVE-2026-4800"
],
"summary": "lodash vulnerable to Code Injection via `_.template` imports key names",
"rating": "HIGH",
"ratingSource": "osv",
"cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"fixedVersions": [
"4.18.0"
],
"published": "2026-04-01T23:51:12Z",
"modified": "2026-10-17T02:56:15.633068434Z"
},
{
"id": "GHSA-xxjr-mmjv-4gpg",
"aliases": [
"CVE-2025-13465"
],
"summary": "Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions",
"rating": "MODERATE",
"ratingSource": "osv",
"cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"fixedVersions": [
"4.17.23",
"4.18.0"
],
"published": "2026-01-21T23:01:22Z",
"modified": "2026-11-04T03:15:10.832238351Z"
}
],
"fix": {
"suggestedVersion": "4.17.21",
"fixesAllListed": false,
"fullFixVersion": "4.18.0"
}
},
{
"name": "minimist",
"version": "1.2.5",
"errors": [],
"package": {
"latestVersion": "1.2.8",
"versionCount": 31,
"license": "MIT",
"modified": "2026-03-06T07:15:54.567Z",
"deprecated": null
},
"vulnerable": true,
"vulnCount": 1,
"vulnTotal": 1,
"vulnReturned": 1,
"truncated": false,
"highestRating": "CRITICAL",
"vulns": [
{
"id": "GHSA-xvch-5gv4-984h",
"aliases": [
"CVE-2021-44906"
],
"summary": "Prototype Pollution in minimist",
"rating": "CRITICAL",
"ratingSource": "osv",
"cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"fixedVersions": [
"1.2.6",
"0.2.4"
],
"published": "2022-03-18T00:01:09Z",
"modified": "2026-03-13T22:11:59.523514Z"
}
],
"fix": {
"suggestedVersion": "1.2.6",
"fixesAllListed": true,
"fullFixVersion": "1.2.6"
}
}
],
"summary": {
"total": 2,
"scanned": 2,
"errored": 0,
"withVulns": 2,
"noOsvRecord": 0,
"totalVulns": 5,
"byRating": {
"CRITICAL": 1,
"HIGH": 1,
"MODERATE": 0,
"LOW": 0,
"unrated": 0
},
"fixList": [
{
"name": "minimist",
"version": "1.2.5",
"highestRating": "CRITICAL",
"deprecated": false,
"suggestedVersion": "1.2.6",
"fullFixVersion": "1.2.6",
"vulnCount": 1
},
{
"name": "lodash",
"version": "4.17.20",
"highestRating": "HIGH",
"deprecated": false,
"suggestedVersion": "4.17.21",
"fullFixVersion": "4.18.0",
"vulnCount": 4
}
],
"deprecatedDataAvailable": true,
"deprecatedCount": 0
}
}
curl --location --request POST 'https://zylalabs.com/api/14804/supplychain+scan+api/38383/scan+dependencies' --header 'Authorization: Bearer YOUR_API_KEY'
--data-raw '{"dependencies": [{"name": "lodash", "version": "4.17.20"}, {"name": "minimist", "version": "1.2.5"}]}'
{
"ok": true,
"service": "SupplyChain Scan",
"version": 1
}
curl --location --request GET 'https://zylalabs.com/api/14804/supplychain+scan+api/38384/health+check' --header 'Authorization: Bearer YOUR_API_KEY'
After signing up, every developer is assigned a personal API access key, a unique combination of letters and digits provided to access to our API endpoint. To authenticate with the SupplyChain Scan API simply include your bearer token in the Authorization header.
| Header | Description |
|---|---|
Authorization
|
Required
Should be Bearer access_key. See "Your API Access Key" above when you are subscribed.
|
No long-term commitment. Upgrade, downgrade, or cancel anytime.
npm dependency scan API: OSV vulnerability records and npm registry data joined per package and version, with a severity-ranked fix list. Batch up to 100.
No. It means OSV has no record for that exact package and version at query time. OSV's coverage is broad but it is the coverage you get; records are added over time. Scan results are a snapshot, not a certificate.
OSV's own rating per record (CRITICAL / HIGH / MODERATE / LOW). The underlying data carries CVSS vector strings, not numeric scores, so this API ranks by rating tier and shows you the vector — it does not invent point scores.
Npm only in this version — both joined sources are keyed to the npm registry. Private or self-hosted registries are not scanned.
The way a human would triage it: packages that are both deprecated and vulnerable first, then by highest severity rating, then by whether a fix is available at all. A deprecated package with no vulnerabilities is reported in the counts, not pushed into the fix list.
It never fails the scan. A malformed entry, an unknown package name or a one-leg upstream failure comes back in its own result slot, marked with the reason, while every other dependency is scanned normally.
To obtain your API key, first sign in to your account and navigate to the API you want to use. From the API's Pricing section, choose a plan and complete the subscription process. Once subscribed, return to the API page and you will see your API Access Key displayed at the top of the documentation page. You can use this key to authenticate your requests.
You can’t switch APIs during the free trial. If you subscribe to a different API, your trial will end and the new subscription will start as a paid plan.
The free trial lasts for 7 days and allows you to make up to 50 API requests.
No, the free trial is available only once, so we recommend using it on the API that interests you the most. Most of our APIs offer a free trial, but some may not include this option.
Yes. If the API offers a free trial, you will see a "Free 7-Day Trial" option in its Pricing section. The trial lasts for 7 days and allows up to 50 API requests, enabling you to evaluate the API before subscribing to a paid plan.
Zyla API Hub is like a big store for APIs, where you can find thousands of them all in one place. We also offer dedicated support and real-time monitoring of all APIs. Once you sign up, you can pick and choose which APIs you want to use. Just remember, each API needs its own subscription. But if you subscribe to multiple ones, you'll use the same key for all of them, making things easier for you.
You can monitor your API usage through the response headers included with every request:
x-zyla-api-calls-monthly-used: Shows the total number of API requests you have used during the current billing period.
x-zyla-api-calls-monthly-remaining: Shows the number of API requests you have remaining for the current billing period.
Yes, you can cancel your subscription at any time. Simply go to the Pricing section of the API you're subscribed to and click the "Unsubscribe" button.
Please note that upgrades, downgrades, and cancellations take effect immediately. Once your subscription is canceled, access to the service will end immediately, regardless of any remaining API calls in your quota.
Please have a look at our Refund Policy: https://zylalabs.com/terms#refund