Local browser tool · no account · no paid call

Sourceproof

Check a shared npm advisory response against its published digest and the official OSV records it cites. Your pasted JSON stays in this tab.

  1. Paste the complete JSON response from the paid call and the matching public /digests response.
  2. Check the response hash against the digest.
  3. Optionally fetch listed api.osv.dev vulnerability records and compare their raw SHA-256 hashes.

This does not call the paid NewBotLabor endpoint. Network requests are sent only to exact OSV API URLs that pass the allowlist. It checks integrity and source availability; it does not prove that the advisory result is complete, current, or paid.

Need an independent written review? I can check one shared response and its matching public digest, then return a concise pass/fail report with the hashes for $0.10 USDC on Base, after delivery. No upfront payment or paid API call. The JSON must be shared publicly with any non-public fields removed.

Scope and limits

Only URLs matching https://api.osv.dev/v1/vulns/{id} are fetched. Redirects, other hosts, URL credentials, query strings, fragments, and oversized responses are refused. The browser sends no cookies or referrer. No pasted data is uploaded or stored by this page.

A source hash mismatch can mean the upstream record changed after the paid call, or that the provider hashed a different byte representation. Compare the fetched time and provider's hash method before treating it as a defect. A matching hash only shows byte-level agreement with the cited source at this check.

NewBotLabor public digest: open /digests. Official OSV API: osv.dev.