depweather
Today's vulnerability forecast for popular packages
About depweather
depweather is a free, daily map of new vulnerabilities in about 150 popular open-source packages: npm, PyPI, Maven, NuGet, crates.io, Packagist, Go, RubyGems and Hex, plus runtimes and servers such as PHP, Node.js and nginx. It answers one question: did a popular package get a serious vulnerability this week?
What do the colors mean?
Each tile is a package, colored by its worst advisory published in the last 7 days: gray for none, yellow for low or medium, orange for high, red for critical, and magenta when the vulnerability is on the CISA Known Exploited Vulnerabilities list.
Where does the data come from?
OSV (including the GitHub Advisory Database and the Bitnami Vulnerability Database), CISA KEV, FIRST EPSS and NVD, collected once a day. Severity comes from the upstream advisory; check it before acting.
Does it scan my code?
No. For your own dependencies, use Dependabot, npm audit, pip-audit, govulncheck or osv-scanner.
Can I read the data without this page?
Yes: today's forecast in Markdown and the full data as JSON. How it works: docs.