Pricing

$20.00 / 1,000 new advisories

Malicious Package Watch — npm/PyPI Supply Chain Alerts

Watch the open-source packages your codebase depends on and get alerted the moment a new security advisory (including typosquat/malicious package takedowns) is published for one - built on the free OSV.dev vulnerability database. Only new advisories are reported after the first baseline check.

Pricing

$20.00 / 1,000 new advisories

Rating

0.0

(0)

Developer

0xGollum

Actor stats

Bookmarked

Total users

Monthly active users

6 days ago

Last modified

Categories

Developer tools

Automation

You can access the Malicious Package Watch — npm/PyPI Supply Chain Alerts programmatically from your own applications by using the Apify API. You can also choose the language preference from below. To use the Apify API, you’ll need an Apify account and your API token, found in API & Integrations in Apify Console.

Python

JavaScript

CLI

OpenAPI

HTTP

MCP

1from apify_client import ApifyClient
2
3# Initialize the ApifyClient with your Apify API token
4# Replace '<YOUR_API_TOKEN>' with your token.
5client = ApifyClient("<YOUR_API_TOKEN>")
6
7# Prepare the Actor input
8run_input = { "packages": [
9        {
10            "name": "lodash",
11            "ecosystem": "npm",
12        },
13        {
14            "name": "requests",
15            "ecosystem": "PyPI",
16        },
17    ] }
18
19# Run the Actor and wait for it to finish
20run = client.actor("0xgollum/malicious-package-watch").call(run_input=run_input)
21
22# Fetch and print Actor results from the run's dataset (if there are any)
23print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
24for item in client.dataset(run.default_dataset_id).iterate_items():
25    print(item)
26
27# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

Malicious Package Watch — npm/PyPI Supply Chain Alerts API in Python

The Apify API client for Python is the official library that allows you to use Malicious Package Watch — npm/PyPI Supply Chain Alerts API in Python, providing convenience functions and automatic retries on errors.

Install the apify-client

$pip install apify-client

Other API clients include:

Malicious Package Watch — npm/PyPI Supply Chain Alerts API in JavaScript

Malicious Package Watch — npm/PyPI Supply Chain Alerts API through CLI

Malicious Package Watch — npm/PyPI Supply Chain Alerts OpenAPI definition

Malicious Package Watch — npm/PyPI Supply Chain Alerts API

Malicious Package Supply Chain Tracker Scraper

jungle_synthesizer/malicious-package-supply-chain-tracker-scraper

Cross-ecosystem feed of confirmed malicious/typosquatted packages across npm, PyPI, crates.io, Go, Maven, NuGet, Packagist and RubyGems, sourced from the OSSF malicious-packages dataset (also feeds OSV.dev). Category taxonomy plus typosquat-target linkage for CI gating. Passive read only.

BowTiedRaccoon

Package Intel: npm + PyPI Metadata & Vulnerability Scraper

studious_allergy_mig/package-intel-scraper

Normalized npm and PyPI package metadata plus OSV.dev vulnerability signals for dependency auditing and supply-chain monitoring.

Conor G

NPM & PyPI CVE Monitor

conceivable_extension/npm-cve-monitor

Checks npm and PyPI packages against the OSV vulnerability database and npm registry. Detects CVEs, suspicious maintainer patterns, and supply chain risks. Paste your package.json or requirements.txt. £0.001 per package checked.

joseph fadero

OSV Package Vulnerability Monitor

orbiscribe/osv-package-vulnerability-monitor

Monitor package vulnerability records from OSV.dev for npm, PyPI, Go, Maven, crates.io, RubyGems, and SBOM-derived package lists.

Orbiscribe Labs

Open Source Vulnerability Scraper (OSV.dev)

chrisp1211/vulnerability-scraper-max

Look up open-source security vulnerabilities from OSV.dev for any package across npm, PyPI, Go, Maven, crates and more. Returns CVE IDs, severity, summary and references. No API key. Pay per vulnerability; empty runs free.

Christian Pichichero

Repo Security Scanner — Malicious Code & Supply Chain

eltociear/mcp-server-security-scanner

Run a supply chain audit on any GitHub repo before you install or depend on it. Scans for malicious code, install-time execution, credential exfiltration and prompt injection. Vet npm/PyPI package sources and MCP servers. Risk level, score and file/line evidence per repo.

Ikko Eltociear Ashimine

Buying Signal Watcher — New B2B Tool Adoption Alerts

0xgollum/buying-signal-watcher

Watch company domains and get alerted the moment one adopts a new high-value tool (Stripe, Intercom, HubSpot, Calendly, Salesloft...) - a real buying-intent signal: fresh budget, right timing to reach out. Run on a schedule; only genuinely new adoptions are reported after the first baseline check.

0xGollum

Open Source Vulnerability Monitor

silicon1235/open-source-vulnerability-monitor

OSV vulnerability monitor for public open-source package advisory changes, severity filters, and fix-aware alerts.

X L

Open Source Dependency Vulnerability Scanner

scrapemint/dependency-vulnerability-scanner

Scan dependencies against the OSV.dev database. Supply packages as ecosystem:name@version (npm, PyPI, Go, Maven, crates.io and more); get one row per known vulnerability with OSV/GHSA id, CVE aliases, severity, affected range, and the fix version. Dedupe mode gives a new-vulnerability feed.

Ken M

5.0

npm & PyPI Package Monitor — Versions & Downloads

vertaizen/package-registry-monitor

Monitor npm & PyPI packages via the open registry APIs — latest version, publish date, monthly downloads, dependencies & maintainers. Monitor mode returns only CHANGES: new versions & download swings. Supply-chain security, devtools & investor signals. Pay per package.