npm Package Vulnerability Lookup (by Version)

{
  "type": "object",
  "required": [
    "ecosystem",
    "package_name",
    "version"
  ],
  "properties": {
    "version": {
      "type": "string",
      "minLength": 1,
      "description": "The exact package version to check, such as 1.2.3."
    },
    "ecosystem": {
      "enum": [
        "npm"
      ],
      "type": "string",
      "description": "The package registry. Only npm is offered."
    },
    "package_name": {
      "type": "string",
      "minLength": 1,
      "description": "The package's name as published on the npm registry."
    }
  },
  "additionalProperties": false
}

{
  "type": "object",
  "properties": {
    "version": {
      "type": "string",
      "description": "The version that was checked."
    },
    "ecosystem": {
      "type": "string",
      "description": "The package registry."
    },
    "package_name": {
      "type": "string",
      "description": "The package that was checked."
    },
    "vulnerabilities": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string",
            "description": "The advisory id."
          },
          "aliases": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "Other ids for the same issue (CVE and GHSA ids)."
          },
          "summary": {
            "type": "string",
            "description": "A one-line summary of the issue."
          },
          "fixed_in": {
            "type": "string",
            "description": "The version that fixes the issue."
          },
          "modified": {
            "type": "string",
            "description": "When the advisory was last modified (ISO 8601)."
          },
          "severity": {
            "type": "string",
            "description": "The severity label, such as high or moderate."
          },
          "published": {
            "type": "string",
            "description": "When the advisory was published (ISO 8601)."
          },
          "references": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "A few reference links for the advisory, not a complete list."
          }
        }
      },
      "description": "One entry per advisory that affects the version."
    },
    "highest_severity": {
      "type": "string",
      "description": "The highest severity label among the listed advisories."
    },
    "total_vulnerabilities": {
      "type": "number",
      "description": "How many advisories are listed, counting overlapping entries separately."
    }
  },
  "description": "The advisories affecting the given package version, as returned after shaping."
}