NPM.Security.Compromised.OSV (NPM v0.7.0)

Copy Markdown View Source

Optional OSV.dev lookup for malicious npm package advisories.

The OpenSSF malicious-packages dataset is published in OSV format and is ingested by OSV.dev. Calls are opt-in so normal installs remain offline and deterministic unless a caller explicitly enables online checks.

Summary

Functions

batch_body(packages)

Build the OSV batch query body for npm package versions.

malicious_advisory?(arg1)

Return whether an OSV advisory is a malicious-package report.

query_body(package, version)

Build the OSV package-version query body for an npm package.

query_package(package, version, opts \\ [])

Query OSV.dev for one npm package version.

query_packages(packages, opts \\ [])

Query OSV.dev for multiple npm package versions.

Functions

batch_body(packages)

@spec batch_body([{String.t(), String.t()}]) :: map()

Build the OSV batch query body for npm package versions.

malicious_advisory?(arg1)

@spec malicious_advisory?(map()) :: boolean()

Return whether an OSV advisory is a malicious-package report.

query_body(package, version)

@spec query_body(String.t(), String.t()) :: map()

Build the OSV package-version query body for an npm package.

query_package(package, version, opts \\ [])

@spec query_package(String.t(), String.t(), keyword()) ::
  {:ok, [map()]} | {:error, term()}

Query OSV.dev for one npm package version.

query_packages(packages, opts \\ [])

@spec query_packages(
  [{String.t(), String.t()}],
  keyword()
) :: {:ok, %{required(String.t()) => [map()]}} | {:error, term()}

Query OSV.dev for multiple npm package versions.