Welcome
Vulnerability data and an OSV-compatible audit API for conda-forge packages.
Basilisk matches conda-forge package versions to advisories from OSV and NVD. You can search the results in the explorer or query them through the OSV-compatible API.
The API is in public beta, so response shapes may still change.
Using the API
Query a package version or a batch of packages.
Terminology
How to read severity, applicability, and coverage.
Architecture
Where the data comes from and how matching works.
Traceability
See what produced a match and which evidence it used.
What goes into a match
purl-associator maps conda-forge packages to upstream package identities. Basilisk combines those mappings with conda-forge repodata and advisories from OSV and NVD.
The matcher is deliberately broad: missing a real vulnerability is worse than returning a result that needs another look. Each match therefore includes its range applicability and identity confidence, along with the source data and matcher version that produced it.
Where to start
- To check a package from a script or audit tool, start with Using the API.
- To browse packages and advisories, open the Basilisk explorer.
- If a result says
unevaluated,version unbounded, ornot checked, see Terminology. - For the pipeline, read the Architecture overview. The range rules and comparators are in How matching works.