{
"scope": "SupplyChain Scan joins two public sources at query time: vulnerability records from OSV (Google's Open Source Vulnerabilities database), matched to the exact package and version, and package records from the npm registry. A dependency with no listed vulnerabilities has no record in OSV for that exact version at query time - that is not a guarantee of safety, and results change as OSV updates. Severity is OSV's rating (CRITICAL / HIGH / MODERATE / LOW), reported with the CVSS vector; no runtime or reachability analysis is performed - whether the vulnerable code path is ever called is not checked. Private registries are not scanned.",
"results": [
{
"name": "lodash",
"version": "4.17.20",
"errors": [],
"package": {
"latestVersion": "4.18.1",
"versionCount": 117,
"license": "MIT",
"modified": "2026-11-09T00:39:03.555Z",
"deprecated": null
},
"vulnerable": true,
"vulnCount": 4,
"vulnTotal": 4,
"vulnReturned": 4,
"truncated": false,
"highestRating": "HIGH",
"vulns": [
{
"id": "GHSA-29mw-wpgm-hmr9",
"aliases": [
"CVE-2020-28500"
],
"summary": "Regular Expression Denial of Service (ReDoS) in lodash",
"rating": "MODERATE",
"ratingSource": "osv",
"cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"fixedVersions": [
"4.17.21"
],
"published": "2022-01-06T20:30:46Z",
"modified": "2025-09-29T21:12:31.102523Z"
},
{
"id": "GHSA-35jh-r3h4-6jhm",
"aliases": [
"CVE-2021-23337"
],
"summary": "Command Injection in lodash",
"rating": "HIGH",
"ratingSource": "osv",
"cvss": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"fixedVersions": [
"4.17.21"
],
"published": "2021-05-06T16:05:51Z",
"modified": "2026-10-17T02:55:38.085813876Z"
},
{
"id": "GHSA-r5fr-rjxr-66jc",
"aliases": [
"CVE-2026-4800"
],
"summary": "lodash vulnerable to Code Injection via `_.template` imports key names",
"rating": "HIGH",
"ratingSource": "osv",
"cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"fixedVersions": [
"4.18.0"
],
"published": "2026-04-01T23:51:12Z",
"modified": "2026-10-17T02:56:15.633068434Z"
},
{
"id": "GHSA-xxjr-mmjv-4gpg",
"aliases": [
"CVE-2025-13465"
],
"summary": "Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions",
"rating": "MODERATE",
"ratingSource": "osv",
"cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"fixedVersions": [
"4.17.23",
"4.18.0"
],
"published": "2026-01-21T23:01:22Z",
"modified": "2026-11-04T03:15:10.832238351Z"
}
],
"fix": {
"suggestedVersion": "4.17.21",
"fixesAllListed": false,
"fullFixVersion": "4.18.0"
}
},
{
"name": "minimist",
"version": "1.2.5",
"errors": [],
"package": {
"latestVersion": "1.2.8",
"versionCount": 31,
"license": "MIT",
"modified": "2026-03-06T07:15:54.567Z",
"deprecated": null
},
"vulnerable": true,
"vulnCount": 1,
"vulnTotal": 1,
"vulnReturned": 1,
"truncated": false,
"highestRating": "CRITICAL",
"vulns": [
{
"id": "GHSA-xvch-5gv4-984h",
"aliases": [
"CVE-2021-44906"
],
"summary": "Prototype Pollution in minimist",
"rating": "CRITICAL",
"ratingSource": "osv",
"cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"fixedVersions": [
"1.2.6",
"0.2.4"
],
"published": "2022-03-18T00:01:09Z",
"modified": "2026-03-13T22:11:59.523514Z"
}
],
"fix": {
"suggestedVersion": "1.2.6",
"fixesAllListed": true,
"fullFixVersion": "1.2.6"
}
}
],
"summary": {
"total": 2,
"scanned": 2,
"errored": 0,
"withVulns": 2,
"noOsvRecord": 0,
"totalVulns": 5,
"byRating": {
"CRITICAL": 1,
"HIGH": 1,
"MODERATE": 0,
"LOW": 0,
"unrated": 0
},
"fixList": [
{
"name": "minimist",
"version": "1.2.5",
"highestRating": "CRITICAL",
"deprecated": false,
"suggestedVersion": "1.2.6",
"fullFixVersion": "1.2.6",
"vulnCount": 1
},
{
"name": "lodash",
"version": "4.17.20",
"highestRating": "HIGH",
"deprecated": false,
"suggestedVersion": "4.17.21",
"fullFixVersion": "4.18.0",
"vulnCount": 4
}
],
"deprecatedDataAvailable": true,
"deprecatedCount": 0
}
}
curl --location --request POST 'https://zylalabs.com/api/14804/supplychain+scan+api/38383/scan+dependencies' --header 'Authorization: Bearer YOUR_API_KEY'
--data-raw '{"dependencies": [{"name": "lodash", "version": "4.17.20"}, {"name": "minimist", "version": "1.2.5"}]}'
{
"ok": true,
"service": "SupplyChain Scan",
"version": 1
}
curl --location --request GET 'https://zylalabs.com/api/14804/supplychain+scan+api/38384/health+check' --header 'Authorization: Bearer YOUR_API_KEY'
注册后,每个开发者都会被分配一个个人 API 访问密钥,这是一个唯一的字母和数字组合,用于访问我们的 API 端点。要使用 供应链扫描 API 进行身份验证,只需在 Authorization 标头中包含您的 bearer token。
| 标头 | 描述 |
|---|---|
授权
|
必需
应为 Bearer access_key. 订阅后,请查看上方的"您的 API 访问密钥"。
|
npm 依赖扫描 API:按包和版本连接的 OSV 漏洞记录和 npm 注册数据,带有严重性排名的修复列表。批量最多 100。
不这意味着OSV在查询时没有该确切软件包和版本的记录OSV的覆盖范围广泛但这是你所得到的覆盖记录会随着时间的推移而添加扫描结果是快照而不是证书
OSV每条记录的自我评级(严重 / 高 / 中 / 低)基础数据包含CVSS向量字符串,而不是数字分数,因此此API根据评级等级进行排名,并向您展示向量——它不编造分数
仅此版本中的npm - 两个合并的来源都与npm注册表相关联 私有或自托管注册表未被扫描
根据人类的优先处理方法:首先处理既被废弃又存在漏洞的包,然后按最高严重性评级排序,再按是否有修复可用排序。一个没有漏洞的被废弃包会被计入统计,但不会被加入修复列表
它从不失败于扫描 一个格式不正确的条目 一个未知的包名称或一次性上游故障会在其自己的结果槽中返回 并标记原因 而其他所有依赖项都正常扫描