Check conda-forge packages against OSV and NVD.

Query the public API or browse the explorer. For each match, you can inspect the source evidence, package identity, and matcher version behind it.

POST /v1/query

{
  "package": {
    "purl": "pkg:conda/conda-forge/pillow@10.2.0"
  }
}

OSV

NVD

conda-forge

The audit endpoints are public and OSV-compatible. You do not need an account or API key.

Audit API

Query one package version or send a batch through the public API.

See where the data comes from and how the matcher puts it together.

See why a match exists, which evidence it used, and when it was produced.