OSV
An open-source vulnerability database and API introduced by Google that aggregates vulnerability information for open-source components across multiple ecosystems, facilitating automated vulnerability matching and alerting.
Timeline (last 90 days)
Tools such as pip list, pipdeptree or pip-audit can be used to output the full dependency graph and, combined with vulnerability databases such as OSV and GitHub Advisory, compare version ranges to confirm whether a vulnerable version has been introduced.
Vulnerability subscription data sources include CVE/NVD, GitHub Security Advisory, OSV and others.
OpenPulse aggregates dependency signals scattered across different sources such as GitHub, npm, PyPI, and the OSV database, and transforms them into early warnings with decision-making value for engineering teams.
Dependency scanning tools partially rely on known vulnerability databases (such as CVE and OSV) for version comparison, and partially identify potentially malicious code by analyzing the dynamic behavioral characteristics of packages; the latter approach has a detection advantage over newly emerging counterfeit packages not yet in vulnerability databases.
All Facts (4)
Tools such as pip list, pipdeptree or pip-audit can be used to output the full dependency graph and, combined with vulnerability databases such as OSV and GitHub Advisory, compare version ranges to confirm whether a vulnerable version has been introduced.
50%UnverifiedVulnerability subscription data sources include CVE/NVD, GitHub Security Advisory, OSV and others.
50%UnverifiedOpenPulse aggregates dependency signals scattered across different sources such as GitHub, npm, PyPI, and the OSV database, and transforms them into early warnings with decision-making value for engineering teams.
50%UnverifiedDependency scanning tools partially rely on known vulnerability databases (such as CVE and OSV) for version comparison, and partially identify potentially malicious code by analyzing the dynamic behavioral characteristics of packages; the latter approach has a detection advantage over newly emerging counterfeit packages not yet in vulnerability databases.
50%