What You Installed Screensaver
The What You Installed screensaver shows OSV. It’s free, runs in your browser, and ESC exits.
Live preview
Press ESC to leave fullscreen. Settings are saved in your browser only.
How the What You Installed screensaver works
The saver reads the source described above and draws it on a canvas — no account, no tracking.
OSV.dev advisories for packages almost everything depends on, read live and key-less. A long history is usually a sign of a well-audited library rather than a dangerous one — mature code has been looked at more.
It refreshes on a schedule, so what you see stays current.
Colours and any options can be changed in settings; nothing is stored beyond your own browser.
What OSV.dev collects
OSV stands for Open Source Vulnerabilities. It is both a vulnerability data format, now hosted by the OpenSSF and originally authored by Google engineers, and the osv.dev service, which aggregates vulnerability databases that use that format. Rather than describing a flaw only in prose, each entry names the affected package by ecosystem (such as PyPI, npm or Go) and name, with ranges of versions where the flaw was introduced and fixed, so a tool can check your dependencies automatically.
Entry IDs take the form database prefix plus identifier, so the prefix shows the source: GHSA for GitHub advisories, PYSEC for PyPI, RUSTSEC for RustSec, GO for the Go Vulnerability Database. An entry’s aliases field lists IDs for the same flaw in other databases, such as a CVE number. The saver queries osv.dev for a set of widely used packages and shows what has been recorded against them.
A count of advisories measures how much scrutiny a package has had as much as how risky it is, and many entries affect only old versions. Whether any advisory affects you depends on the version you actually run.
A worked example
OSV.dev advisories for packages almost everything depends on, read live and key-less. A long history is usually a sign of a well-audited library rather than a dangerous one — mature code has been looked at more.
Settings & tips
- Accent and Background recolour the display.
- Every value on screen comes from the live source — nothing is simulated.
- Press ESC to leave fullscreen.
Frequently asked questions
- Is this real data?
- Yes — it comes from the source named on this page and is refreshed on a schedule.
- Is a key needed?
- No. This source is fully key-less.
- Is it free?
- Yes, and it runs entirely in your browser.
- Is a package with many advisories unsafe?
- Not by itself. Popular, heavily audited libraries accumulate more reports because more people look for flaws, and many entries have already been fixed in newer releases.
- What are the ID prefixes like GHSA and PYSEC?
- They show which database assigned the identifier: GHSA is GitHub, PYSEC is PyPI, RUSTSEC is RustSec and GO is the Go Vulnerability Database. A single flaw can carry several IDs that point at each other as aliases.
- How does this differ from the CVE list?
- A CVE is an identifier for a flaw, while OSV records are organised around specific packages and version ranges, which makes them easier to match against a project’s dependencies. OSV entries often list a CVE as an alias.