Advisory databases label packages by an ecosystem name and a package name, and they are not the names of your build tools. In the OSV format, Go is Go, Rust is crates.io, .NET is NuGet, PHP is Packagist, Ruby is RubyGems, Swift is SwiftURL, and Java is Maven. Kotlin projects usually map to Maven.
Lookup table
| Your language | Build tool | OSV ecosystem string | The package name is |
|---|---|---|---|
| Go | go modules | Go | A Go module path |
| Rust | Cargo | crates.io | A crate name |
| C# and .NET | NuGet | NuGet | A NuGet package name |
| PHP | Composer | Packagist | A package name |
| Ruby | Bundler | RubyGems | A gem name |
| Swift | Swift Package Manager | SwiftURL | A Git URL, versions are Git tags that follow SemVer 2.0 |
| Java and Kotlin | Maven or Gradle | Maven | groupId and artifactId separated by a colon |
These come from the OSV schema documentation. The schema does not mention Kotlin or Gradle by name, so the mapping of Gradle projects to Maven coordinates is how Maven Central libraries are identified, not a separate ecosystem.
Naming details that trip tools up
Packagist and Maven can carry a repository. Both allow an optional suffix with a remote repository URL. If omitted, Packagist assumes packagist.org and Maven assumes Maven Central.
Swift uses the Git URL as the name. Two spellings of the same URL can look like two packages if a tool does not normalize them.
Go uses the full module path. Major version suffixes are part of the path, so a v2 module is a different name. See our post on the v2 suffix.
The GitHub Advisory Database uses its own labels. Its reviewed advisories use names such as Composer, Go, Maven, NuGet, RubyGems, Rust and Swift, named after the language's associated package registry. Swift lists no registry. So a label you see in one database may differ from the OSV string for the same ecosystem.
Why this matters when you pick a scanner
- Ask which ecosystems it matches advisories for, using the OSV strings.
- Test it with a project that has a private or custom repository, since the repository suffix is where matching often fails.
- For Swift, test a dependency by URL and by tag.
- For Gradle builds, check that Maven coordinates are extracted from the resolved graph and not only from a build file.
Reading a record
An advisory record says ecosystem, package name and affected versions. To check it by hand, find your resolved version in the lockfile and compare it with the affected range. If you use a git or path source, there may be no version to compare, and you have to read the advisory.
Quick check
What is the ecosystem string for Rust crates?
crates.io, with the crate name as the package name.
Is there a separate ecosystem for Kotlin?
The OSV schema does not list one. Kotlin libraries published to Maven repositories use the Maven ecosystem with groupId:artifactId names.
Safeguard's SBOM and dependency scanning builds an inventory of components with their ecosystems and versions. You can see yours with the free scan.
Sources
Last reviewed: 19 October 2026.
