Attestd vs OSV

OSV.dev is a free, open, and genuinely excellent aggregated vulnerability database maintained by Google. Attestd ingests OSV as one of several upstream sources. This is not which database is better. It is what you get querying OSV directly versus querying the synthesis built on top of it.

OSV gives you the matched record. Attestd gives you the decision.

OSV-Scanner is free, Apache 2.0, and offline capable. Point it at a lockfile or query by package, version, and ecosystem, and it returns every matched advisory record: CVE, GHSA, MAL, and others. That list is accurate and transparent. It is also unfinished work for anything that needs a yes/no. There is no actively_exploited, no synthesized supply_chain.compromised, and no single risk_state. The caller still has to cross-reference CISA KEV, decide severity, and interpret the list.

Attestd ingests OSV as one upstream source, then synthesizes it with NVD, CISA KEV, and npm/PyPI registry signals into a precomputed fact. One product and version returns the decision fields an agent or provisioning script can branch on directly.

When an OSV MAL advisory exists, Attestd surfaces it as supply_chain.compromised. When the compromise is confirmed by a registry signal before an OSV entry lands, Attestd's registry layer still returns the flag. OSV alone cannot do that until the advisory is published.

{
  "vulns": [{
    "id": "GHSA-xxxx-xxxx-xxxx",
    "aliases": ["CVE-2024-XXXXX"],
    "summary": "Prototype pollution in example-package",
    "affected": [{ "package": { "name": "example-package" }, "ranges": [{ "type": "SEMVER" }] }]
  }]
}

{
  "risk_state": "high",
  "actively_exploited": false,
  "patch_available": true,
  "fixed_version": "2.1.0",
  "supply_chain": {
    "compromised": false
  }
}

This is not theoretical

OSV is a source Attestd builds on. Four incidents in Attestd's public detection ledger had no OSV entry at the time of compromise. Attestd's registry and behavioral layers closed that gap while OSV still returned an empty match list.

• →90+ @mastra packages compromised with no CVEs
• →Two @joyfill packages delivering a RAT with no postinstall hook
• →debug and chalk, an estimated 10% of cloud environments exposed within two hours
• →ViteVenom: six packages using blockchain C2 built to survive takedown

All four return supply_chain.compromised: true from Attestd. None had a CVE or OSV entry at the time of compromise.

What you get from each

Pricing

OSV-Scanner is Apache 2.0 and free with no tiers. Attestd's free tier is 1,000 calls per month. Solo is $19.99 per month for 10,000 calls. This comparison is not really about price. It is about how much synthesis you want to do yourself versus receive precomputed.

When OSV is the right choice

OSV is right when you want a free, transparent, self-hostable scanner over your own manifests, especially for offline or air-gapped scanning or auditing the matching logic yourself.

When attestd is the right choice

• →You want the exploitation and supply chain synthesis already done, not just the matched advisory list
• →You are checking one package at a time from inside a running system, not scanning a whole project
• →You want OSV, NVD, and KEV cross-referenced into a single risk_state instead of resolving that yourself
• →You do not want to maintain a local database mirror or scanning pipeline

Try it in 30 seconds

Get a free API key at the developer portal, then connect Attestd to your coding assistant via the setup docs.

curl "https://api.attestd.io/v1/check?product=nginx&version=1.20.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"