Search the library on deps.dev to see its versions, dependency graph and linked advisories, then query OSV for known vulnerabilities in the exact version you plan to use. Both are free public services. Five minutes will not prove a library safe, but it quickly catches obvious problems.
What the two tools are
OSV, at osv.dev, is an aggregator of vulnerability databases that use the OpenSSF vulnerability format. It also works to keep affected-version information accurate in each entry, and its first-party scanner, OSV-Scanner, uses the same data.
deps.dev, called Open Source Insights, is a Google-hosted service that builds a dependency graph for each package. It indexes Cargo, Go, Maven, npm, NuGet, PyPI and RubyGems, plus GitHub, GitLab and Bitbucket project hosts, and includes OSV advisories. It offers a website, an API and a public BigQuery dataset.
The five-minute routine
Minute 1: find the exact package. On deps.dev, search by name and ecosystem. Confirm the repository link matches the project you expect. Look-alike names exist, so check the source link and publisher.
Minute 2: look at versions. Note the latest version, the version you plan to use, and how far apart they are. A large gap means more upgrade work later.
Minute 3: check advisories. Open the advisories listed for your version. For each, read the fixed version and whether it is below or above the one you plan to use.
Minute 4: cross-check in OSV. Search the package name at osv.dev and compare. Different sources occasionally disagree on affected versions, so note any mismatch.
Minute 5: scan the graph. Look at the dependency list for anything surprising, then record results in your library checklist.
How to read what you find
| Finding | Reasonable response |
|---|---|
| No advisories at all | Neutral. Few reviewers or a clean record; check other signals |
| Advisories fixed in older versions | Fine if you use a fixed version, and see how fast fixes came |
| Open advisory, no fixed version | Hold, ask the maintainers, consider alternatives |
| Many advisories in the transitive graph | Review footprint; see dependency footprint check |
Counts alone mislead. Judge severity, fix speed and whether the vulnerable code would be reachable in your use. The OpenSSF Scorecard Vulnerabilities check uses OSV to look for open, unfixed vulnerabilities in a project's own code or its dependencies, which shows how the same data feeds other checks.
Limits
- Databases list known issues. A flaw nobody has reported will not appear.
- Entries vary in detail and timing between ecosystems.
- Neither tool judges license, maintenance or intent.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how findings are grouped and prioritized once you have more than a handful.
Where Safeguard fits
For your own projects, Safeguard's SBOM and dependency scanning plus zero-day discovery and reachability analysis go beyond a one-off lookup. Try the free scan at gold.safeguard.sh/scan.
Quick check
Is a library with zero advisories safe?
Not necessarily. Zero known advisories may mean few reviewers. Check other signals.
Should I trust one database over the other?
Use both and investigate disagreements. Read the advisory text and the fixed version for yourself.
Sources
Last reviewed: 19 October 2026.
