Pricing

from $0.80 / 1,000 record scrapeds

Try for free

Go to Apify Store

Malicious Package Supply Chain Tracker Scraper

Try for free

Cross-ecosystem feed of confirmed malicious/typosquatted packages across npm, PyPI, crates.io, Go, Maven, NuGet, Packagist and RubyGems, sourced from the OSSF malicious-packages dataset (also feeds OSV.dev). Category taxonomy plus typosquat-target linkage for CI gating. Passive read only.

Pricing

from $0.80 / 1,000 record scrapeds

Rating

0.0

(0)

Developer

BowTiedRaccoon

Actor stats

Bookmarked

Total users

Monthly active users

3 days ago

Last modified

category

Optional

malware | typosquat | dependency_confusion | protestware | compromised (heuristic classification from summary/details)

Type:string | null

Typosquat Of

typosquat_of

Optional

Legitimate package name this one appears to imitate, when detectable from the advisory text

Type:string | null

Affected Versions

affected_versions

Optional

Array of affected version strings

Type:string[] | null

Summary

summary

Optional

One-line advisory summary

Type:string | null

Details

details

Optional

Full advisory details / analyst notes

Type:string | null

Published

published

Optional

ISO 8601 timestamp the advisory was first published

Type:string | null

Modified

modified

Optional

ISO 8601 timestamp the advisory was last modified

Type:string | null

Source Dataset

source_dataset

Optional

Origin dataset tag: ossf (all records currently sourced from github.com/ossf/malicious-packages, which also feeds OSV.dev's MAL-* advisories)

Type:string | null

References

references

Optional

Array of reference URLs / finder credit links

Type:string[] | null

Severity

severity

Optional

Severity if present in the advisory's database_specific block; malicious-package advisories are CRITICAL by convention when unset

Type:string | null

Withdrawn

withdrawn

Optional

true if the advisory carries a withdrawn timestamp (retracted)

Type:boolean | null

Scraped At

scraped_at

Optional

ISO 8601 timestamp this actor run captured the record

Type:string | null

Malicious Package Watch — npm/PyPI Supply Chain Alerts

0xgollum/malicious-package-watch

Watch the open-source packages your codebase depends on and get alerted the moment a new security advisory (including typosquat/malicious package takedowns) is published for one - built on the free OSV.dev vulnerability database. Only new advisories are reported after the first baseline check.

0xGollum

OSV Package Vulnerability Scanner

technicaldost/osv-package-vulnerability-scanner

Find vulnerabilities for npm, PyPI, Maven, Go, NuGet, RubyGems, and crates.io packages.

Technical Dost Solutions

Package Registry Intelligence — npm, PyPI, crates & more

straightforward_hydra/package-registry-intelligence

One tool over 6 package registries (npm, PyPI, crates.io, RubyGems, NuGet, Packagist): version, license, repo, maintainer, downloads & dependencies. Keyless. For supply-chain & dev intel.

Dev D

OSV Package Vulnerability Monitor

orbiscribe/osv-package-vulnerability-monitor

Monitor package vulnerability records from OSV.dev for npm, PyPI, Go, Maven, crates.io, RubyGems, and SBOM-derived package lists.

Orbiscribe Labs

Repo Security Scanner — Malicious Code & Supply Chain

eltociear/mcp-server-security-scanner

Run a supply chain audit on any GitHub repo before you install or depend on it. Scans for malicious code, install-time execution, credential exfiltration and prompt injection. Vet npm/PyPI package sources and MCP servers. Code and docs get separate risk levels, with file/line evidence.

Ikko Eltociear Ashimine

Dependency Guard — AI Package Safety Check

blueberry_delicacy/dependency-guard

Catch the fake, malicious and typosquatted packages your AI told you to install — before they ship.

Laurent Ferrenti

OSV Scraper – Open Source Vulnerabilities for npm, PyPI & Go

ninhothedev/osv-scraper

$0.5/1K 🔥 Fast OSV vulnerability scraper! Package vulns across npm, PyPI, Go, Maven, crates, RubyGems & more — severity, aliases & fixed versions. JSON, CSV, Excel or API in seconds. Scan dependencies & pull thousands of advisories ⚡

ninhothedev

Open Source Dependency Vulnerability Scanner

scrapemint/dependency-vulnerability-scanner

Scan dependencies against the OSV.dev database. Supply packages as ecosystem:name@version (npm, PyPI, Go, Maven, crates.io and more); get one row per known vulnerability with OSV/GHSA id, CVE aliases, severity, affected range, and the fix version. Dedupe mode gives a new-vulnerability feed.

Ken M

5.0

OSV.dev Vulnerabilities Scraper

crawlerbros/osv-vulnerabilities-scraper

Scrape OSV.dev, Google's open vulnerability database covering NPM, PyPI, Go, Maven, NuGet, Cargo, RubyGems, GitHub Actions, OS distros, and more. Look up vulnerabilities by package, fetch a specific OSV/GHSA/CVE record, or batch-query an entire dependency tree.

Crawler Bros

Open Source Vulnerability Scraper (OSV.dev)

chrisp1211/vulnerability-scraper-max

Look up open-source security vulnerabilities from OSV.dev for any package across npm, PyPI, Go, Maven, crates and more. Returns CVE IDs, severity, summary and references. No API key. Pay per vulnerability; empty runs free.