NPM & PyPI CVE Monitor

Check your npm and PyPI packages against the OSV vulnerability database, npm audit, and GitHub Advisory Database in one run. Paste your package.json or requirements.txt. £0.001/package — protect your supply chain for pennies.

Post-Shai-Hulud (Sep 2025): supply chain monitoring is no longer optional.

Features

• OSV database — checks against the Open Source Vulnerabilities database (Google, GitHub, CISA — free, no auth)
• npm registry metadata — detects suspicious maintainer patterns, unusual publish velocity, and ownership transfer signals
• package.json + requirements.txt — parse and check entire dependency trees in one run
• Severity filtering — report only critical, high, medium, or all vulnerabilities
• Remediation paths — suggests upgrade target versions where CVE fixes exist

Inputs

Field	Default	Description
packageJson	—	Paste package.json content
requirementsTxt	—	Paste requirements.txt content
npmPackages	[]	Individual npm package names
pypiPackages	[]	Individual PyPI package names
checkSuspiciousPatterns	true	Check npm registry for suspicious maintainer patterns
severityFilter	medium	Minimum severity to report

Output fields

Each package record includes: packageName, ecosystem, installedVersion, vulnerabilities[], vulnerabilityCount, highestSeverity, hasSuspiciousPatterns, suspiciousPatternDetails, weeklyDownloads, lastPublishedAt, maintainerCount, isDeprecated, recommendedAction, upgradeTarget.

Suspicious pattern detection

Flags packages with:

• 5 version publishes in 7 days (worm-like velocity)

• Package <30 days old with >10k weekly downloads
• Single maintainer on >100k downloads/week package

Pricing (PPE)

• run-started — £0.05 per run
• package-checked — £0.001 per package examined
• vulnerability-found — £0.04 per package with CVEs
• suspicious-pattern-detected — £0.05 per package with suspicious patterns

Related actors

• LLM-Ready Web Scraper — extract security advisory and documentation pages as clean text for AI pipelines
• Website Change Tracker — monitor npm, PyPI and GitHub Advisory Database pages for new security notices