AbsoluteJS

@absolutejs/vulnerabilities-osv

@absolutejs/vulnerabilities-osvv0.1.8betaPlatform & Infra

Official OSV API ingestion and advisory normalization for AbsoluteJS vulnerability management.

#Installation

BASH
bun add @absolutejs/vulnerabilities-osv

#Capabilities

Overview

Official OSV API ingestion for @absolutejs/vulnerabilities. The package normalizes OSV records into the shared advisory contract, preserves aliases, affected package ranges, CVSS vectors, and source provenance, and follows per-query pagination from the OSV batch API.

Each batch result remains aligned with its source query. Pagination tokens are followed independently, advisory identifiers are deduplicated, and each full record is retrieved from the official OSV API before normalization.

Outcomes

What you can build

Build on the supported package contract

Use @absolutejs/vulnerabilities-osv through its supported public entry points.

Hardening checklist

Production guidance

Make every external boundary explicitPin the deployed @absolutejs/vulnerabilities-osv version, replace example or memory-backed dependencies with durable implementations, bound external calls, protect credentials, and emit enough evidence to retry or recover safely.

Follow in order

Troubleshooting path

1
Trace from the first failed boundary
Reproduce the smallest canonical @absolutejs/vulnerabilities-osv example, confirm the supported entry point and version in the API explorer, then inspect the first boundary that did not produce its documented result.

#@absolutejs/vulnerabilities-osv quick start

Partial snippet

# @absolutejs/vulnerabilities-osv

TS
import { createOsvAdapter } from "@absolutejs/vulnerabilities-osv";
import { createMemoryFeedStore, syncFeed } from "@absolutejs/vulnerabilities";

const adapter = createOsvAdapter({
  queries: [
    {
      package: { ecosystem: "npm", name: "lodash" },
      version: "4.17.20",
    },
  ],
});

const result = await syncFeed({
  adapter,
  maxStaleMs: 24 * 60 * 60 * 1_000,
  store: createMemoryFeedStore(),
});

#Public entry points

Supported entry points declared by this package manifest.

Package entry point declared in package.json.

@absolutejs/vulnerabilities-osv@absolutejs/vulnerabilities-osv/manifest@absolutejs/vulnerabilities-osv/manifest.json

#Package commands

Scripts declared by this package manifest.

bun run buildrm -rf dist && bun build src/index.ts src/manifest.ts --outdir dist --target=bun --external @absolutejs/manifest --external @absolutejs/vulnerabilities --external '@absolutejs/vulnerabilities/*' --external @sinclair/typebox && tsc -p tsconfig.build.json && absolute-manifest emit
bun run check:packagebun run format && bun run typecheck && bun run test && bun run verify-package && bun run build && bun run verify-package --artifacts
bun run formatprettier --write "./**/*.{ts,json,md}"
bun run testbun test
bun run typechecktsc --noEmit

#API reference

Search the declarations exported by the current package type files. Expand a symbol to inspect its source-backed signature.

7 symbols
OSV_API_URLvaluePermalinkSource
TS
const OSV_API_URL = "https://api.osv.dev/v1";
Exported from @absolutejs/vulnerabilities-osv