Skip to main content
FOSSA Logo

Open source packages

Reference pages for open source packages across npm, PyPI, and Maven. Each page shows the top-level declared license, known CVE-linked advisories, version history, and the licenses that appear across the package's transitive dependency tree. Package metadata comes from the public registries and deps.dev, advisory data from OSV; FOSSA builds the same view against your own codebase, where a full scan detects licenses that declared metadata misses.

Most in-demand packages

Licenses shown are each package's top-level declared license.

  • eslint-plugin-react-hooksnpmThe library for web and native user interfaces.
    MITNo known CVE-linked advisories
  • tiktokenPyPItiktoken is a fast BPE tokeniser for use with OpenAI's models.
    License: unresolved in metadataNo known CVE-linked advisories
  • pdfplumberPyPIPlumb a PDF for detailed information about each char, rectangle, line, et cetera — and easily extract text and tables.
    MITNo known CVE-linked advisories
  • cycloptsPyPIIntuitive, easy CLIs based on python type hints.
    Apache-2.0No known CVE-linked advisories
  • langchain-openaiPyPIThe agent engineering platform.
    MITNo known CVE-linked advisories
  • paramikoPyPIThe leading native Python SSHv2 protocol library.
    LGPL-2.1No known CVE-linked advisories
  • aiohttpPyPIAsynchronous HTTP client/server framework for asyncio and Python
    Apache-2.0 AND MITNo known CVE-linked advisories
  • awscliPyPIUniversal Command Line Interface for Amazon Web Services
    Apache-2.0No known CVE-linked advisories
  • jsdomnpmA JavaScript implementation of various web standards, for use with Node.js
    MITNo known CVE-linked advisories
  • gcsfsPyPIPythonic file-system interface for Google Cloud Storage
    BSD-3-ClauseNo known CVE-linked advisories
  • pydantic-settingsPyPISettings management using pydantic
    MITNo known CVE-linked advisories
  • ipykernelPyPIIPython Kernel for Jupyter
    BSD-3-ClauseNo known CVE-linked advisories
  • pygithubPyPITyped interactions with the GitHub API v3
    License: unresolved in metadataNo known CVE-linked advisories
  • dbt-corePyPIdbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.
    Apache-2.0No known CVE-linked advisories
  • pytest-covPyPICoverage plugin for pytest.
    MITNo known CVE-linked advisories
  • pre-commitPyPIA framework for managing and maintaining multi-language pre-commit hooks.
    MITNo known CVE-linked advisories
  • langchain-corePyPIThe agent engineering platform.
    MITNo known CVE-linked advisories
  • google-api-python-clientPyPI🐍 The official Python client library for Google's discovery based APIs.
    Apache-2.0No known CVE-linked advisories
  • pytest-xdistPyPIpytest plugin for distributed testing and loop-on-failures testing modes.
    MITNo known CVE-linked advisories
  • pytest-mockPyPIThin-wrapper around the mock package for easier use with pytest
    MITNo known CVE-linked advisories

Recently updated

Licenses shown are each package's top-level declared license.

  • langchain-openaiPyPIThe agent engineering platform.
    v1.6.6 Sep 2026MITNo known CVE-linked advisories
  • jsdomnpmA JavaScript implementation of various web standards, for use with Node.js
    v30.1.1 Sep 2026MITNo known CVE-linked advisories
  • dbt-corePyPIdbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.
    v1.12.5 Sep 2026Apache-2.0No known CVE-linked advisories
  • cycloptsPyPIIntuitive, easy CLIs based on python type hints.
    v4.23.2 Aug 2026Apache-2.0No known CVE-linked advisories
  • google-api-python-clientPyPI🐍 The official Python client library for Google's discovery based APIs.
    v2.199.0 Aug 2026Apache-2.0No known CVE-linked advisories
  • pygithubPyPITyped interactions with the GitHub API v3
    v2.10.0 Aug 2026License: unresolved in metadataNo known CVE-linked advisories
  • langchain-corePyPIThe agent engineering platform.
    v1.6.0 Aug 2026MITNo known CVE-linked advisories
  • tiktokenPyPItiktoken is a fast BPE tokeniser for use with OpenAI's models.
    v0.14.0 Aug 2026License: unresolved in metadataNo known CVE-linked advisories
  • gcsfsPyPIPythonic file-system interface for Google Cloud Storage
    v2026.8.0 Aug 2026BSD-3-ClauseNo known CVE-linked advisories
  • pre-commitPyPIA framework for managing and maintaining multi-language pre-commit hooks.
    v4.6.2 Aug 2026MITNo known CVE-linked advisories
  • snowflake-connector-pythonPyPISnowflake Connector for Python
    v4.7.2 Aug 2026Apache-2.0No known CVE-linked advisories
  • pydantic-settingsPyPISettings management using pydantic
    v2.15.0 Aug 2026MITNo known CVE-linked advisories
  • awscliPyPIUniversal Command Line Interface for Amazon Web Services
    v1.46.0 Aug 2026Apache-2.0No known CVE-linked advisories
  • ipythonPyPIOfficial repository for IPython itself. Other repos in the IPython organization contain things like the website, documentation builds, etc.
    v9.16.1 Aug 2026BSD-3-ClauseNo known CVE-linked advisories
  • aiobotocorePyPIasyncio support for botocore library using aiohttp
    v3.9.0 Aug 2026Apache-2.0No known CVE-linked advisories
  • aiohttpPyPIAsynchronous HTTP client/server framework for asyncio and Python
    v3.14.3 Jul 2026Apache-2.0 AND MITNo known CVE-linked advisories
  • google-cloud-secret-managerPyPIGoogle Cloud Client Libraries for Python
    v2.30.0 Jul 2026Apache-2.0No known CVE-linked advisories
  • google-cloud-computePyPIGoogle Cloud Client Libraries for Python
    v1.50.0 Jul 2026Apache-2.0No known CVE-linked advisories
  • textualPyPIThe lean application framework for Python. Build sophisticated user interfaces with a simple Python API. Run your apps in the terminal and a web browser.
    v8.2.8 Jun 2026MITNo known CVE-linked advisories
  • pdfplumberPyPIPlumb a PDF for detailed information about each char, rectangle, line, et cetera — and easily extract text and tables.
    v0.11.10 Jun 2026MITNo known CVE-linked advisories

Browse every package

These pages read declared metadata. Run the same license and vulnerability view across your dependencies, where a full scan resolves what metadata leaves out.

Scan free

Dependency graph and package metadata from deps.dev (Google Open Source Insights), used under CC BY 4.0.

Vulnerability data from the Open Source Vulnerability (OSV) database, including the GitHub Advisory Database and the PyPI Advisory Database, used under CC BY 4.0. Only CVE-linked advisories are shown.

License and vulnerability information on this page is derived from public package metadata and public advisory databases. It is not legal advice, and it reflects the top-level declared license only. Verify the license and terms of any software for your own needs.