# Dependency Supply Chain Monitor (`k.pavlenko/dependency-supply-chain-monitor`) Actor - **URL**: https://apify.com/k.pavlenko/dependency-supply-chain-monitor.md - **Developed by:** [Kostiantyn Pavlenko](https://apify.com/k.pavlenko) (community) - **Categories:** Agents, Integrations - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $60.00 / 1,000 package checkeds This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## npm & PyPI Supply Chain Monitor Monitor your npm and PyPI packages for **supply chain attacks** — typosquats, hijacked maintainer accounts, surprise deprecations, license changes, and new or yanked versions — automatically, on a schedule. This npm and PyPI supply chain monitor gives security and platform teams an early-warning feed for the packages they depend on (or the package names they publish and want to protect) for a few cents per check, instead of a per-developer SaaS seat like Snyk ($25/dev/mo). It is a *stateful monitor*, not a one-off scraper: every run is compared against the previous run, so you get **what changed**, not a re-dump of the registry. It runs entirely on the official npm and PyPI APIs — **no AI cost, no proxy cost, no npm account**. **Why it catches what Snyk and OSV/CVE monitors miss:** most 2026 supply-chain attacks ship with **zero CVEs** — a typosquat or a hijacked maintainer account is not a disclosed vulnerability, so tools that watch CVE feeds (Snyk, Dependabot, OSV.dev monitors) never see it. Recent proof: the *Mastra → `easy-day-js` typosquat* (Jul 1, 2026), the 17-package Paysafe/Skrill/Neteller typosquat cluster (Jul 7, 2026), and the self-propagating *Mini Shai-Hulud* worm across npm and PyPI. This actor watches the **attack signals themselves** — new look-alike names and maintainer changes — not just the CVE list. ### How does npm and PyPI supply chain monitoring work? - **Detect typosquats** — scan npm and PyPI for newly-published look-alike names within a set edit distance of your packages (the classic malware-delivery vector behind attacks like the *colorama → colorizr* PyPI campaign). - **Catch maintainer takeovers** — get alerted the moment an owner or maintainer is added or removed, the strongest account-hijack signal. - **Track new versions** — know within one run when a dependency ships a release, so you can review it before it lands in your build. - **Spot deprecations and yanks** — surface npm deprecations and PyPI yanked releases as soon as they happen. - **Watch license drift** — flag a surprise relicense before it becomes a compliance problem. - **Diff every run** — persistent snapshots mean you only see changes, never noise. ### Why use this instead of Snyk, Socket, or a CVE/OSV monitor? | Capability | This Actor | Snyk / Dependabot | Socket | OSV / CVE monitors | PyPI/npm scrapers | |---|---|---|---|---|---| | Cost | **~$0.06 / package / run** | $25/dev/mo+ | Per contributor | Varies | Per result | | Catches **0-CVE** attacks (typosquat, takeover) | Yes | No | Partial | **No** (CVE-only) | No | | Typosquat name detection | Yes | No | Partial | No | No | | Maintainer-takeover alerts | Yes | Limited | Yes | No | No | | Stateful run-over-run diff (not a re-dump) | Yes | Yes | Yes | Yes | **No** | | Watch package names you don't install | Yes | No | No | No | Yes | | npm + PyPI in one run | Yes | Yes | Yes | Yes | Usually one | | No seat / account required | Yes | No | No | Varies | Yes | Snyk and Socket are full org-wide SCA platforms priced per developer or contributor; OSV/CVE monitors and the PyPI/npm dependency-intelligence scrapers on the Store either watch **known vulnerabilities** or **dump metadata** one run at a time. This actor does something none of them do: it **diffs supply-chain integrity signals run-over-run** — new look-alike names and maintainer changes — for exactly the packages **you** name, including ones you don't install (like your own published package names), for pennies per check. ### What can you monitor on npm and PyPI? - **Version changes** — every new version with its publish timestamp, plus latest-vs-previous tracking. - **Security signals** — added or removed maintainers (takeover), newly deprecated versions (npm), newly yanked releases (PyPI). - **Legal and compliance** — a package's license value changing between runs. - **Typosquats** — look-alike package names with their edit distance, alerting only on names that are *new* since the last run so you aren't re-pinged about known ones. ### How to use the supply chain monitor 1. **Add your packages** — list them as `registry:name` (for example `npm:express`, `npm:@babel/core`, `pypi:requests`), or point the actor at a `package.json` or `requirements.txt` URL to watch an entire project at once. 2. **Choose what to watch** — toggle versions, deprecations, license, maintainers, and yanks, and set the typosquat edit distance (default 2). 3. **Run once for a baseline** — the first run records a snapshot and reports no changes by design. 4. **Schedule it** — hourly or daily; every later run reports only what changed. 5. **Wire up alerts** — connect Apify's Slack, webhook, or email integrations to push changes straight to your team. ### How much does supply chain monitoring cost? Pricing is **pay-per-event**: you are charged per package checked per run. No subscription, no proxy fees, no AI surcharge. | Packages watched | Schedule | Approx. monthly cost | |---|---|---| | 10 | Daily | ~$18 | | 25 | Daily | ~$45 | | 50 | Weekly | ~$12 | Compare: Snyk starts at **$25 per developer per month** and Socket bills **per contributor** — both priced for an entire engineering org. This actor watches just the packages you care about for a few cents per check, with no seats to buy. ### Input example ```json { "packages": ["npm:express", "npm:@babel/core", "pypi:requests"], "manifestUrls": ["https://raw.githubusercontent.com/acme/api/main/package.json"], "watchTyposquats": true, "typosquatDistance": 2, "checkNewVersions": true, "checkDeprecations": true, "checkLicenseChanges": true, "checkMaintainerChanges": true, "checkYanked": true } ```` ### What does the output look like? ```json { "package": "express", "registry": "npm", "latestVersion": "5.2.1", "previousLatestVersion": "5.2.0", "isFirstRun": false, "checkedAt": "2026-07-09T12:00:00.000Z", "summary": { "latestVersion": "5.2.1", "totalVersions": 312, "maintainers": 3, "license": "MIT", "typosquatsWatched": 2, "changesDetected": 2 }, "changes": { "newVersions": [{ "version": "5.2.1", "publishedAt": "2026-07-08T09:12:00Z" }], "deprecations": [], "licenseChanges": [], "maintainersAdded": [], "maintainersRemoved": [], "yankedReleases": [], "newTyposquats": [{ "name": "expres", "distance": 1 }] }, "currentlyDeprecatedVersions": [], "currentlyYankedVersions": [], "typosquats": [ { "name": "expres", "distance": 1 }, { "name": "expresss", "distance": 1 } ] } ``` ### Who uses the npm and PyPI supply chain monitor? - **AppSec engineers** — a lightweight, schedulable supply-chain watch feeding Slack or a SIEM, covering the packages that matter most without a full SCA rollout. - **Platform and DevEx teams** — get told when a production dependency deprecates, relicenses, or changes maintainers before it breaks a build. - **Open-source maintainers** — protect your own package name by watching for typosquats and impersonators the day they appear. - **Engineering managers** — a cheap, auditable record of dependency and ownership changes across a portfolio of critical packages. - **Security researchers** — track maintainer and version churn across npm and PyPI to spot suspicious activity early. - **Compliance and legal teams** — catch license drift on dependencies before it turns into a licensing violation. ### Frequently asked questions **How do you detect typosquatting in npm and PyPI?** For each package you watch, the actor scans the registry for names within a chosen Levenshtein edit distance (default 2) and reports look-alikes that are new since the last run — the same technique used to catch malicious clones like `expres` or `python-requests` impersonators. **How can I get alerted when an npm package is deprecated?** Add the package to your watch list and keep `checkDeprecations` on. When any version is newly marked deprecated on npm, it appears in that run's `deprecations` array; wire an Apify integration to push it to Slack or a webhook. **Can I monitor PyPI for malicious or yanked packages?** Yes. On PyPI the security-relevant signals are yanked releases and maintainer changes; both are tracked per run, alongside typosquat scanning against the full PyPI project index. **How do I know if an npm package changed maintainers?** Maintainer add/remove is diffed every run and reported in `maintainersAdded` / `maintainersRemoved` — the classic account-takeover indicator behind many recent supply-chain incidents. **Does this need proxies or an npm account?** No. It uses the public npm registry and PyPI JSON APIs, which have no anti-bot and require no login, key, or proxy. **Does it use AI?** No. Typosquat detection is pure edit-distance math and everything else is JSON diffing, so there are no model API costs. **Which registries are supported?** npm and PyPI today. RubyGems and other ecosystems are on the roadmap. **How is this different from Snyk or Dependabot?** Snyk and Dependabot focus on known CVEs and version bumps in repos you own. This actor focuses on **supply-chain integrity signals** — typosquats, maintainer takeovers, deprecations, yanks, license drift — for any package names you choose, including ones you only want to watch, not install. **How is this different from an OSV.dev / CVE vulnerability monitor?** CVE and OSV monitors alert on *disclosed vulnerabilities* — but a fresh typosquat or a hijacked maintainer account has no CVE, often for days or forever. This actor watches the pre-CVE attack signals (new look-alike names, maintainer add/remove) so you're warned before anything reaches a vulnerability feed. **How is this different from the PyPI/npm scrapers on the Store?** Those return a metadata snapshot each run (dependencies, versions, maintainer contact info). This is a *stateful monitor*: it stores each run and reports only what **changed** since last time, and it adds typosquat and takeover detection those scrapers don't perform. ### Limitations - The actor detects **metadata** changes (versions, license, maintainers, typosquats); it does not download or statically analyze package code. - Deprecation flags are an npm concept; on PyPI the equivalent signal is a **yanked** release. - PyPI typosquat scanning uses the full project index (~850k names) cached for 24 hours, so the first PyPI scan in a day takes a few extra seconds. - npm typosquat candidates come from registry search relevance, so extremely obscure squats may not surface until they are indexed. - The first run for each package is a baseline and intentionally reports no changes. # Actor input Schema ## `packages` (type: `array`): One entry per package as "registry:name". Use "npm:" for npm and "pypi:" for PyPI. Scoped npm packages are supported (e.g. "npm:@babel/core"). Entries without a prefix default to npm. ## `manifestUrls` (type: `array`): Raw URLs to a package.json or requirements.txt file. Every dependency found is added to the watch list automatically. ## `watchTyposquats` (type: `boolean`): Scan each registry for newly-published packages whose name is a near look-alike of a watched package. ## `typosquatDistance` (type: `integer`): Maximum Levenshtein edit distance for a name to count as a typosquat (1-3). Lower = stricter. ## `checkNewVersions` (type: `boolean`): Report versions published since the previous run. ## `checkDeprecations` (type: `boolean`): Report versions newly marked as deprecated (npm). ## `checkLicenseChanges` (type: `boolean`): Report when a package's license changes. ## `checkMaintainerChanges` (type: `boolean`): Report when maintainers/owners are added or removed (takeover signal). ## `checkYanked` (type: `boolean`): Report versions newly yanked (PyPI). ## `proxyConfiguration` (type: `object`): Optional proxy settings. Not required — npm and PyPI registry APIs have no anti-bot. ## Actor input object example ```json { "packages": [ "npm:left-pad", "npm:@babel/core", "pypi:requests" ], "manifestUrls": [], "watchTyposquats": true, "typosquatDistance": 2, "checkNewVersions": true, "checkDeprecations": true, "checkLicenseChanges": true, "checkMaintainerChanges": true, "checkYanked": true } ``` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "packages": [ "npm:left-pad", "npm:@babel/core", "pypi:requests" ], "manifestUrls": [] }; // Run the Actor and wait for it to finish const run = await client.actor("k.pavlenko/dependency-supply-chain-monitor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "packages": [ "npm:left-pad", "npm:@babel/core", "pypi:requests", ], "manifestUrls": [], } # Run the Actor and wait for it to finish run = client.actor("k.pavlenko/dependency-supply-chain-monitor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "packages": [ "npm:left-pad", "npm:@babel/core", "pypi:requests" ], "manifestUrls": [] }' | apify call k.pavlenko/dependency-supply-chain-monitor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=k.pavlenko/dependency-supply-chain-monitor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Dependency Supply Chain Monitor", "version": "0.1", "x-build-id": "P6fnx6hXlDjWWewF7" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/k.pavlenko~dependency-supply-chain-monitor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-k.pavlenko-dependency-supply-chain-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/k.pavlenko~dependency-supply-chain-monitor/runs": { "post": { "operationId": "runs-sync-k.pavlenko-dependency-supply-chain-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/k.pavlenko~dependency-supply-chain-monitor/run-sync": { "post": { "operationId": "run-sync-k.pavlenko-dependency-supply-chain-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "packages" ], "properties": { "packages": { "title": "Packages to monitor", "type": "array", "description": "One entry per package as \"registry:name\". Use \"npm:\" for npm and \"pypi:\" for PyPI. Scoped npm packages are supported (e.g. \"npm:@babel/core\"). Entries without a prefix default to npm.", "items": { "type": "string" } }, "manifestUrls": { "title": "Manifest URLs (optional)", "type": "array", "description": "Raw URLs to a package.json or requirements.txt file. Every dependency found is added to the watch list automatically.", "items": { "type": "string" } }, "watchTyposquats": { "title": "Detect typosquats", "type": "boolean", "description": "Scan each registry for newly-published packages whose name is a near look-alike of a watched package.", "default": true }, "typosquatDistance": { "title": "Typosquat edit distance", "minimum": 1, "maximum": 3, "type": "integer", "description": "Maximum Levenshtein edit distance for a name to count as a typosquat (1-3). Lower = stricter.", "default": 2 }, "checkNewVersions": { "title": "Alert on new versions", "type": "boolean", "description": "Report versions published since the previous run.", "default": true }, "checkDeprecations": { "title": "Alert on deprecations", "type": "boolean", "description": "Report versions newly marked as deprecated (npm).", "default": true }, "checkLicenseChanges": { "title": "Alert on license changes", "type": "boolean", "description": "Report when a package's license changes.", "default": true }, "checkMaintainerChanges": { "title": "Alert on maintainer changes", "type": "boolean", "description": "Report when maintainers/owners are added or removed (takeover signal).", "default": true }, "checkYanked": { "title": "Alert on yanked releases", "type": "boolean", "description": "Report versions newly yanked (PyPI).", "default": true }, "proxyConfiguration": { "title": "Proxy Configuration", "type": "object", "description": "Optional proxy settings. Not required — npm and PyPI registry APIs have no anti-bot." } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```