Pricing

$20.00 / 1,000 new advisories

Malicious Package Watch — npm/PyPI Supply Chain Alerts

Watch the open-source packages your codebase depends on and get alerted the moment a new security advisory (including typosquat/malicious package takedowns) is published for one - built on the free OSV.dev vulnerability database. Only new advisories are reported after the first baseline check.

Pricing

$20.00 / 1,000 new advisories

Rating

0.0

(0)

Developer

0xGollum

Actor stats

Bookmarked

Total users

Monthly active users

6 days ago

Last modified

Configure MCP server with Malicious Package Watch — npm/PyPI Supply Chain Alerts

The configuration above connects to the hosted Apify MCP server with the Malicious Package Watch — npm/PyPI Supply Chain Alerts Actor already loaded. It uses OAuth, so your client opens a browser window to sign you in to Apify on first use. No API token is needed. Clients without OAuth support can authenticate with an Authorization: Bearer header carrying an API token from API & Integrations in Apify Console.

Get a ready-to-use configuration for your MCP client with the Malicious Package Watch — npm/PyPI Supply Chain Alerts Actor preconfigured at https://mcp.apify.com/?tools=fetch-actor-details,0xgollum/malicious-package-watch.

You can connect to the Apify MCP Server using clients like Tester MCP Client, or any other MCP client of your choice.

If you want to learn more about our Apify MCP implementation, check out our MCP documentation. To learn more about the Model Context Protocol in general, refer to the official MCP documentation or read our blog post.

Malicious Package Supply Chain Tracker Scraper

jungle_synthesizer/malicious-package-supply-chain-tracker-scraper

Cross-ecosystem feed of confirmed malicious/typosquatted packages across npm, PyPI, crates.io, Go, Maven, NuGet, Packagist and RubyGems, sourced from the OSSF malicious-packages dataset (also feeds OSV.dev). Category taxonomy plus typosquat-target linkage for CI gating. Passive read only.

BowTiedRaccoon

Package Intel: npm + PyPI Metadata & Vulnerability Scraper

studious_allergy_mig/package-intel-scraper

Normalized npm and PyPI package metadata plus OSV.dev vulnerability signals for dependency auditing and supply-chain monitoring.

Conor G

NPM & PyPI CVE Monitor

conceivable_extension/npm-cve-monitor

Checks npm and PyPI packages against the OSV vulnerability database and npm registry. Detects CVEs, suspicious maintainer patterns, and supply chain risks. Paste your package.json or requirements.txt. £0.001 per package checked.

joseph fadero

OSV Package Vulnerability Monitor

orbiscribe/osv-package-vulnerability-monitor

Monitor package vulnerability records from OSV.dev for npm, PyPI, Go, Maven, crates.io, RubyGems, and SBOM-derived package lists.

Orbiscribe Labs

Open Source Vulnerability Scraper (OSV.dev)

chrisp1211/vulnerability-scraper-max

Look up open-source security vulnerabilities from OSV.dev for any package across npm, PyPI, Go, Maven, crates and more. Returns CVE IDs, severity, summary and references. No API key. Pay per vulnerability; empty runs free.

Christian Pichichero

Repo Security Scanner — Malicious Code & Supply Chain

eltociear/mcp-server-security-scanner

Run a supply chain audit on any GitHub repo before you install or depend on it. Scans for malicious code, install-time execution, credential exfiltration and prompt injection. Vet npm/PyPI package sources and MCP servers. Risk level, score and file/line evidence per repo.

Ikko Eltociear Ashimine

Buying Signal Watcher — New B2B Tool Adoption Alerts

0xgollum/buying-signal-watcher

Watch company domains and get alerted the moment one adopts a new high-value tool (Stripe, Intercom, HubSpot, Calendly, Salesloft...) - a real buying-intent signal: fresh budget, right timing to reach out. Run on a schedule; only genuinely new adoptions are reported after the first baseline check.

0xGollum

Open Source Vulnerability Monitor

silicon1235/open-source-vulnerability-monitor

OSV vulnerability monitor for public open-source package advisory changes, severity filters, and fix-aware alerts.

X L

Open Source Dependency Vulnerability Scanner

scrapemint/dependency-vulnerability-scanner

Scan dependencies against the OSV.dev database. Supply packages as ecosystem:name@version (npm, PyPI, Go, Maven, crates.io and more); get one row per known vulnerability with OSV/GHSA id, CVE aliases, severity, affected range, and the fix version. Dedupe mode gives a new-vulnerability feed.

Ken M

5.0

npm & PyPI Package Monitor — Versions & Downloads

vertaizen/package-registry-monitor

Monitor npm & PyPI packages via the open registry APIs — latest version, publish date, monthly downloads, dependencies & maintainers. Monitor mode returns only CHANGES: new versions & download swings. Supply-chain security, devtools & investor signals. Pay per package.