# Package Supply-Chain Monitor — npm & PyPI Intel (`brick_joey_yto/supply-chain-monitor`) Actor New npm/PyPI package firehose, metadata + download counts, and typosquat detection — scheduled supply-chain security watching for your packages. - **URL**: https://apify.com/brick_joey_yto/supply-chain-monitor.md - **Developed by:** [William Billings](https://apify.com/brick_joey_yto) (community) - **Categories:** Developer tools, Automation, Business - **Features:** Limited permissions - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing $1.00 / 1,000 results This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event ## What's an Apify Actor? An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md. ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run. For examples already wired to this Actor's own input schema, see the [API](#api) section below. Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`). # README ## Package Supply-Chain Monitor — npm & PyPI Intel **Watch the open-source supply chain for new packages and typosquat attacks — keyless, via the official npm and PyPI feeds.** The same kind of alert services like Socket.dev and Snyk sell, at $0.001 per row. ### Who it's for - **Security & platform teams** — flag typosquat lookalikes of your packages before they're installed - **Maintainers** — track your own packages' metadata, downloads, and release cadence - **Researchers & threat-intel** — firehose of everything new hitting the registries ### What it does | Mode | What it does | |---|---| | **new** | The newest packages hitting npm (registry changes feed) and PyPI (new-packages RSS) — names, versions, maintainers, descriptions | | **search** | Full metadata + weekly download counts for any npm or PyPI package | | **watch** | **Typosquat alerts** — polls the newest packages and flags any name within edit-distance 2 of your target list (`react`, `lodash`, `requests`...) | **Schedule `watch`** and get a daily alert whenever a new package tries to impersonate the ones your team depends on — the #1 supply-chain attack vector. ### Example inputs ```json { "mode": "new", "limit": 150 } { "mode": "search", "packages": ["requests", "axios", "lodash"] } { "mode": "watch", "watchTargets": ["mypackage", "requests", "lodash"], "limit": 300 } ``` ### Example row ```json { "recordType": "typosquat_alert", "registry": "npm", "name": "lodashjs", "similarTo": "lodash", "editDistance": 2, "version": "1.0.0", "maintainers": ["anon-user"], "url": "https://www.npmjs.com/package/lodashjs" } ``` ### Example output ```json { "recordType": "package_event", "name": "lodash-es", "ecosystem": "npm", "version": "4.17.22", "event": "new_version", "downloads7d": 42000000, "publisher": "jdalton", "scrapedAt": "2026-11-03T12:00:00+00:00" } ``` ### Pricing $0.001 per row — no subscription. ### More from this developer - [Resale Radar](https://apify.com/brick_joey_yto/resale-radar) — Poshmark + Depop + Grailed sniper feed - [Vinted Monitor](https://apify.com/brick_joey_yto/vinted-monitor) — EU resale listings & sniper alerts - [YouTube Transcript Engine](https://apify.com/brick_joey_yto/youtube-transcript-engine) — batch subtitles & captions for AI pipelines - [Gov Contract Monitor](https://apify.com/brick_joey_yto/gov-contract-monitor) — SAM.gov opportunities + federal awards - [SEC 13F Monitor](https://apify.com/brick_joey_yto/sec-13f-monitor) — institutional fund holdings (Berkshire, ARK...) - [DFS Props Monitor](https://apify.com/brick_joey_yto/dfs-props-monitor) — player prop lines & line-movement alerts - [Capitol Trades Monitor](https://apify.com/brick_joey_yto/capitol-trades-monitor) — Congress stock-trade alerts (STOCK Act PTRs) - [Perp DEX Monitor](https://apify.com/brick_joey_yto/perp-dex-monitor) — Lighter/Aster/Pacifica funding & spreads - [Hyperliquid Monitor](https://apify.com/brick_joey_yto/hyperliquid-monitor) — funding rates, OI & whale-position tracking - [DeFiLlama Monitor](https://apify.com/brick_joey_yto/defillama-monitor) — DeFi TVL, yield pools & protocol watch - [Crypto Market Monitor](https://apify.com/brick_joey_yto/crypto-market-monitor) — CoinGecko trending, movers & price watch - [TradingView Screener](https://apify.com/brick_joey_yto/tradingview-screener) — market scan & TA alerts (gainers/oversold/buy-rated) - [Hiring Signal Monitor](https://apify.com/brick_joey_yto/hiring-signal-monitor) — company hiring velocity & job-board intel - [Investor Edge Monitor](https://apify.com/brick_joey_yto/investor-edge-monitor) — earnings, IPOs, insiders & SEC filings feed - [Noon Monitor](https://apify.com/brick_joey_yto/noon-monitor) — noon.com price tracking & deals - [Discord Directory Monitor](https://apify.com/brick_joey_yto/discord-directory-monitor) — discord server discovery & growth - [Municipal Data Monitor](https://apify.com/brick_joey_yto/municipal-data-monitor) — business licenses & permits across US cities - [ImportYeti Monitor](https://apify.com/brick_joey_yto/importyeti-monitor) — supply-chain intel from US import data # Actor input Schema ## `mode` (type: `string`): new = newest packages on npm+PyPI; search = package metadata + downloads; watch = typosquat detection (schedule it) ## `packages` (type: `array`): search mode: npm or PyPI package names ## `watchTargets` (type: `array`): watch: names to protect — new packages within edit-distance 2 are flagged ## `npmSinceSeq` (type: `integer`): 0 = start from latest; >0 = resume the npm firehose from a sequence number ## `limit` (type: `integer`): new/watch: how many newest packages to scan ## `maxResults` (type: `integer`): Max rows to emit ## Actor input object example ```json { "mode": "new", "packages": [ "requests", "lodash", "react" ], "watchTargets": [ "react", "lodash", "express", "axios", "requests", "numpy", "flask", "django" ], "npmSinceSeq": 0, "limit": 100, "maxResults": 100 } ``` # Actor output Schema # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = {}; // Run the Actor and wait for it to finish const run = await client.actor("brick_joey_yto/supply-chain-monitor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = {} # Run the Actor and wait for it to finish run = client.actor("brick_joey_yto/supply-chain-monitor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}") for item in client.dataset(run.default_dataset_id).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{}' | apify call brick_joey_yto/supply-chain-monitor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "type": "http", "url": "https://mcp.apify.com/?tools=fetch-actor-details,brick_joey_yto/supply-chain-monitor" } } } ``` The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations). ## OpenAPI specification Download the OpenAPI definition: https://api.apify.com/v2/actors/lw3AnFtFUXzE0aFDw/builds/mIPfw7L9k6x4ENVTu/openapi.json