Malicious Package Supply Chain Tracker Scraper

Malicious Package Watch — npm/PyPI Supply Chain Alerts

0xgollum/malicious-package-watch

Watch the open-source packages your codebase depends on and get alerted the moment a new security advisory (including typosquat/malicious package takedowns) is published for one - built on the free OSV.dev vulnerability database. Only new advisories are reported after the first baseline check.

OSV Package Vulnerability Scanner

technicaldost/osv-package-vulnerability-scanner

Find vulnerabilities for npm, PyPI, Maven, Go, NuGet, RubyGems, and crates.io packages.

One tool over 6 package registries (npm, PyPI, crates.io, RubyGems, NuGet, Packagist): version, license, repo, maintainer, downloads & dependencies. Keyless. For supply-chain & dev intel.

Monitor package vulnerability records from OSV.dev for npm, PyPI, Go, Maven, crates.io, RubyGems, and SBOM-derived package lists.

Run a supply chain audit on any GitHub repo before you install or depend on it. Scans for malicious code, install-time execution, credential exfiltration and prompt injection. Vet npm/PyPI package sources and MCP servers. Code and docs get separate risk levels, with file/line evidence.

Catch the fake, malicious and typosquatted packages your AI told you to install — before they ship.

OSV Scraper – Open Source Vulnerabilities for npm, PyPI & Go

ninhothedev/osv-scraper

$0.5/1K 🔥 Fast OSV vulnerability scraper! Package vulns across npm, PyPI, Go, Maven, crates, RubyGems & more — severity, aliases & fixed versions. JSON, CSV, Excel or API in seconds. Scan dependencies & pull thousands of advisories ⚡

Scan dependencies against the OSV.dev database. Supply packages as ecosystem:name@version (npm, PyPI, Go, Maven, crates.io and more); get one row per known vulnerability with OSV/GHSA id, CVE aliases, severity, affected range, and the fix version. Dedupe mode gives a new-vulnerability feed.

OSV.dev Vulnerabilities Scraper

crawlerbros/osv-vulnerabilities-scraper

Scrape OSV.dev, Google's open vulnerability database covering NPM, PyPI, Go, Maven, NuGet, Cargo, RubyGems, GitHub Actions, OS distros, and more. Look up vulnerabilities by package, fetch a specific OSV/GHSA/CVE record, or batch-query an entire dependency tree.

Look up open-source security vulnerabilities from OSV.dev for any package across npm, PyPI, Go, Maven, crates and more. Returns CVE IDs, severity, summary and references. No API key. Pay per vulnerability; empty runs free.