The OSV data page lists 29 ecosystems, including npm, PyPI, Maven, NuGet, Go, crates.io, RubyGems, Packagist, Hex, Pub, GitHub Actions, the Linux kernel and several Linux distributions. If a technology you use is not named, do not assume it is safe. It may be covered under another name, or by no database at all.
The list, grouped
As listed on 19 October 2026, the OSV data page names these ecosystems:
| Group | Ecosystems |
|---|---|
| Language packages | crates.io, Go, Hex, Haskell, Julia, Maven, npm, NuGet, opam, Packagist, Pub, PyPI, Python, R (CRAN and Bioconductor), RubyGems, SwiftURL |
| Operating system | AlmaLinux, Alpine, Debian GNU/Linux, Rocky Linux, Ubuntu OS, Linux kernel, Android, Root |
| Other | Bitnami, Curl, Git, GitHub Actions, OSS-Fuzz |
Treat the live page as the source of truth, because the list changes.
What a gap means
A missing name is a question, not a verdict. Three cases:
- Covered under a different ecosystem name. C and C++ projects often show up through Git commit ranges or OSS-Fuzz rather than a package manager name.
- Covered by another database. A vendor or distribution may publish advisories somewhere else.
- Not covered anywhere. Some package managers and many internal components have no public advisory source.
Having a database does not guarantee depth either. Entries per ecosystem vary widely, and our advisory data quality scorecard shows how to measure it.
How to check your own stack
- List every package manager and OS in your builds. Include containers, CI actions and mobile.
- Match each to the OSV list. Note exact ecosystem strings.
- For each unmatched item, search for a vendor or maintainer advisory feed.
- Pick one real library per ecosystem and check that your scanner returns advisories for a known old version.
- Write the result in a coverage table: ecosystem, source, tested date.
Our scanner ecosystem coverage checklist has a longer version.
Naming pitfall: prefixed ecosystems
OSV records for some distributions used suffixes such as a release number after the ecosystem name. The data page says prefixed ecosystems (its example is Alpine with a version) are no longer exported, and tells users to use the unprefixed name. If your parser matches on the old string, you may be missing records without an error.
Why GitHub Actions on the list matters
GitHub Actions appears as an ecosystem, so workflows that pin an action can be checked like any dependency. Many teams scan application code and forget pipelines. See restricting which GitHub Actions your organization can run for the control side.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, asset discovery and reachability analysis. Use the free scan at gold.safeguard.sh/scan as a quick check against a repository you know, then compare its results with the list above. This post makes no claim about how many records any tool holds.
Try it yourself
Click through it at your own pace, or open it full screen.
Note how the inventory groups components by ecosystem.
Quick check
How many ecosystems does OSV list?
The data page listed 29 on 19 October 2026. Check the page, because it changes.
Is a missing ecosystem a clean bill of health?
No. It may be covered by another source or not covered at all.
Why do my Alpine records look empty?
OSV no longer exports prefixed ecosystem names. Match on the unprefixed name.
Sources
- OSV.dev, Data dumps and sources, fetched 19 October 2026.
Last reviewed: 19 October 2026.
