Class OsvClient

Main entry point for the OSV (Open Source Vulnerabilities) API client.

Example

import { OsvClient } from 'osv-api-client';

const osv = new OsvClient();

// Get a vulnerability by OSV ID (awaitable directly)
const vuln = await osv.vuln('GHSA-jfh8-c2jp-hdp8');
console.log(vuln.summary);

// Query vulnerabilities affecting a specific package version
const result = await osv.query({
  package: { name: 'lodash', ecosystem: 'npm' },
  version: '4.17.20',
});

// Batch query for multiple packages at once
const batch = await osv.queryBatch([
  { package: { name: 'lodash', ecosystem: 'npm' }, version: '4.17.20' },
  { package: { name: 'express', ecosystem: 'npm' }, version: '4.17.1' },
]);

Constructors

constructor

Methods

on query queryBatch vuln

Constructors

constructor

Methods

on

  • on<K extends "request">(event: K, callback: OsvClientEvents[K]): this

    Subscribes to a client event.

    Type Parameters

    • K extends "request"

    Parameters

    Returns this

    Example

    osv.on('request', (event) => {
      console.log(`${event.method} ${event.url} — ${event.durationMs}ms`);
      if (event.error) console.error('Request failed:', event.error);
    });

query

  • query(params: OsvQueryParams): Promise<OsvQueryResult>

    Queries vulnerabilities affecting a specific package version or git commit.

    POST /v1/query

    Parameters

    • params: OsvQueryParams

      Query parameters (package + version, or commit)

    Returns Promise<OsvQueryResult>

    Matching vulnerabilities and optional pagination token

    Example

    const result = await osv.query({
      package: { name: 'lodash', ecosystem: 'npm' },
      version: '4.17.20',
    });
    result.vulns?.forEach(v => console.log(v.id, v.summary));

queryBatch

  • queryBatch(queries: OsvBatchQuery[]): Promise<OsvBatchQueryResult>

    Queries vulnerabilities for multiple packages in a single request.

    POST /v1/querybatch

    Results are returned in the same order as the input queries array.

    Parameters

    Returns Promise<OsvBatchQueryResult>

    One result entry per query, in the same order

    Example

    const batch = await osv.queryBatch([
      { package: { name: 'lodash', ecosystem: 'npm' }, version: '4.17.20' },
      { package: { name: 'express', ecosystem: 'npm' }, version: '4.17.1' },
    ]);
    batch.results.forEach((r, i) => {
      console.log(`Query ${i}: ${r.vulns?.length ?? 0} vulnerabilities`);
    });

vuln

  • vuln(id: string): VulnerabilityResource

    Returns a VulnerabilityResource for a given OSV ID. The resource can be awaited directly to fetch the full vulnerability record.

    GET /v1/vulns/{id}

    Parameters

    • id: string

      OSV vulnerability ID (e.g. 'GHSA-jfh8-c2jp-hdp8', 'CVE-2021-44228')

    Returns VulnerabilityResource

    A chainable vulnerability resource

    Example

    const vuln = await osv.vuln('GHSA-jfh8-c2jp-hdp8');
    console.log(vuln.summary);
    console.log(vuln.severity);

Settings

Member Visibility

On This Page

Constructors
Methods