Malicious Package Watch — npm/PyPI Supply Chain Alerts
Pricing
$20.00 / 1,000 new advisories
Malicious Package Watch — npm/PyPI Supply Chain Alerts
Watch the open-source packages your codebase depends on and get alerted the moment a new security advisory (including typosquat/malicious package takedowns) is published for one - built on the free OSV.dev vulnerability database. Only new advisories are reported after the first baseline check.
Pricing
$20.00 / 1,000 new advisories
Rating
0.0
(0)
Developer
0xGollum
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
6 days ago
Last modified
Categories
Share
Watch the open-source packages your codebase depends on and get alerted the moment a new security advisory is published for one — including typosquat and malicious-package takedowns, not just ordinary CVEs. Run on a schedule; only advisories new since the last check are reported, never the full advisory history dumped as "alerts" on the very first run.
How it works
Consumes the free, no-auth public API of OSV.dev — Google's open-source
vulnerability database, which already aggregates advisories from GitHub Security Advisories,
PyPA, npm, RustSec, and other ecosystem-specific sources — and adds the part it doesn't offer:
a per-package watchlist with alert-only-on-new-advisory logic across scheduled runs. Verified
live against the real API (api.osv.dev/v1/querybatch) before shipping.
Checked against Apify Store before building (08/08/2026): no existing competitor does scheduled diff-based monitoring of package advisories — the few related tools are one-off scanners, not watch-and-alert.
Input
- Packages (required) — list of
{"name": ..., "ecosystem": ...}objects. Ecosystem:npm,PyPI,Go,crates.io,Packagist,RubyGems,Maven, orNuGet. - Request timeout.
Output
One row per newly published advisory: package, vuln_id, summary, severity,
published, checked_at.
Known constraints
- Coverage depends entirely on what OSV.dev aggregates — it's broad but not exhaustive across every ecosystem.
- First-ever check for a package establishes a silent baseline (no rows) rather than dumping its historical advisories as if they just happened — alerts start from the second run onward.
