Comparison · pkgscan.dev

OSV tracks what's known. Argus reads what's new.

OSV's the open advisory database — free, broad, and the right source for known vulnerabilities and published malware advisories. It only knows what's been reported, and that window before disclosure is where Argus works.

Scan a package or file · All comparisons

Where Argus is different

Published vs observed

OSV knows what maintainers and databases have published. Argus looks at the artifact itself, so a fresh typosquat with no advisory still gets flagged.

Identity vs behaviour

OSV matches a PURL and a version range. Argus reads the archive — install scripts and bundled code included — which an advisory would never describe.

Different answer, same report

pkgscan runs both. OSV brings CVEs and MAL- advisories; Argus brings the malware verdict. You don't have to choose.

No false confidence

A clean OSV lookup means 'no known advisory', not 'safe'. The report shows which engines ran and what they actually returned.

How Argus and OSV compare

OSV's foundational for vulnerability management. It's not a content engine, and content analysis isn't an advisory database — they cover different halves of the same problem.

Capability	Argus	Opponent
Detection
Approach	Content + structure analysis	Advisory matching by PURL
Flags a package with no advisory	Yes	No
Reports known CVEs	No	Yes
Matches MAL- malware advisories	No	Yes
Reads executable code	Yes	No
Inputs and coverage
Artifact bytes	Yes	No
Registry PURL	Partial	Yes
SHA-256 only	No	No
Ecosystem breadth	Every artifact pkgscan fetches	Ecosystems with advisories
Agent skills	Yes	No
Operations
Runs without setup	Yes	Yes
Open source / open data	No	Yes
Runs as a registry publish gate	Yes	No
Cost	Free tier, paid plans	Free
Best at	Novel malicious code	Known vulnerabilities and advisories

Choose Argus or OSV

Choose Argus when

The package is new, recently transferred, or has no release history.
You care about install-time behaviour, not only version ranges.
You're checking a marketplace extension where advisories lag.
You need a verdict on the bytes you're about to install.

Choose OSV when

You need canonical CVE and MAL- advisory data.
You want to query by PURL without downloading anything.
You maintain a vulnerability process and already track advisories.
You need coverage across ecosystems outside pkgscan's fetch list.

Most npm and PyPI attacks are live before they're listed

The disclosure gap

A malicious publish usually has hours or days before it's reported, yanked and added to an advisory database. During that window advisory-based tools return clean. Content analysis doesn't depend on someone else noticing first.

Argus inspects the package that's in front of you, not the version ranges in a feed.
Advisories stay essential after disclosure, which is why pkgscan keeps OSV in every eligible scan.
Reports show both sources, so a clean advisory doesn't hide a behavioural finding.

Use OSV for history, Argus for the artifact

Working together

The pair covers both sides of the risk: known history and current behaviour. pkgscan runs OSV, Grype, deps.dev and Argus in one submission so you don't have to sequence them yourself.

OSV and Grype: known CVEs and advisories.
deps.dev: package metadata and advisory signals.
Argus: the malware read on the actual bytes.

Questions about Argus vs OSV

Does Argus detect CVEs?

No — Argus is a malware engine. pkgscan adds OSV, Grype and deps.dev for CVEs, so one scan covers both malware and vulnerabilities.

Can OSV detect a brand-new malicious package?

Only after someone publishes an advisory for it. OSV's an advisory database; it doesn't analyse package code.

Is OSV free?

Yes — OSV's an open project from Google/OpenSSF with a free API. pkgscan queries it for eligible package identities.

Compare Argus with other engines

vs GuardDog · vs SkillSpector · vs Grype · vs deps.dev

Machine-readable copy: /comparison.json.