Dependency Advisory Monitor

OSV & GitHub Security

📊 Sample Output

package	advisoryId	summary	cveIds	published	modified
lodash	GHSA-29mw-wpgm-hmr9	Regular Expression Denial of Service (ReDoS) in lodash	['CVE-2020-28500']	2022-01-06T20:30:46Z	2025-09-29T21:12:31.102523Z
lodash	GHSA-35jh-r3h4-6jhm	Command Injection in lodash	['CVE-2021-23337', 'CVE-2026-4800']	2021-05-06T16:05:51Z	2026-09-10T03:49:04.067984836Z
lodash	GHSA-4xc9-xhrj-v574	Prototype Pollution in lodash	['CVE-2018-16487']	2019-02-07T18:16:48Z	2025-08-12T21:55:35.778975Z
lodash	GHSA-f23m-r3pf-42rh	lodash vulnerable to Prototype Pollution via array path bypass in `_.…	['CVE-2025-13465', 'CVE-2026-2950']	2026-04-01T23:50:27Z	2026-09-10T03:50:44.050013812Z
lodash	GHSA-fvqr-27wr-82fm	Prototype Pollution in lodash	['CVE-2018-3721']	2018-07-26T15:14:52Z	2025-08-12T21:55:16.003066Z
lodash	GHSA-jf85-cpcp-j695	Prototype Pollution in lodash	['CVE-2019-10744']	2019-07-10T19:45:23Z	2026-09-10T03:47:55.238868631Z

Real rows from run PaAZuWBCwNkFQ2vW3 on build 0.0.6 (2026-09-24), unedited apart from masked emails/phones and shortened long text; fields the source does not publish are empty.

⚙️ Sample inputs

This is the Store example input — the same input Apify's automated check runs — so it is proven to return rows on the current build. Paste it into the input form, or send it through the API, CLI or a schedule:

{
  "packages": [
    "npm:lodash",
    "pypi:django"
  ],
  "maxPerPackage": 0
}

🔧 Input reference

Field	Type	Default	What it does
packages (required)	array	["npm:lodash", "pypi:django"]	Each as "ecosystem:name", e.g. npm:lodash, pypi:django, maven:org.apache.logging.log4j:log4j-core, go:golang.org/x/net.
maxPerPackage	integer	0	0 = all.

🧾 JSON sample record

One real record from run PaAZuWBCwNkFQ2vW3 (emails/phones masked, long text shortened):

{
  "package": "lodash",
  "ecosystem": "npm",
  "advisoryId": "GHSA-29mw-wpgm-hmr9",
  "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
  "severity": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "cveIds": [
    "CVE-2020-28500"
  ],
  "published": "2022-01-06T20:30:46Z",
  "modified": "2025-09-29T21:12:31.102523Z",
  "affected": [
    {
      "introduced": "4.0.0"
    },
    {
      "fixed": "4.17.21"
    },
    {
      "introduced": "4.0.0"
    },
    {
      "fixed": "4.17.21"
    },
    {
      "introduced": "4.0.0"
    },
    {
      "introduced": "4.0.0"
    },
    {
      "introduced": "4.0.0"
    },
    {
      "fixed": "4.17.21"
    }
  ],
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2020-28500",
    "https://github.com/github/advisory-database/pull/6139",
    "https://github.com/lodash/lodash/pull/5065",
    "https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7",
    "https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a"
  ]
}

💰 Pricing

Event	Price (USD)	When it is charged
Actor Start (apify-actor-start)	$0.005	Charged when the Actor starts running. Number of events charged depends on Actor memory (one event per GB, minimum one event).
Advisory (advisory-record)	$0.03	Charged per advisory.

Pay-per-event: you pay only for what the run delivers. A run that delivers nothing bills no result events (only the actor-start event, when the actor defines one). Example: a run that delivers 100 results costs 100 × $0.03 = $3.00 plus the start fee.

🔗 Related Actors

More from the NexGenData Data APIs family:

• Corporate Actions Tracker — Splits, Dividends & More
• CPSC Product Recalls & Safety Tracker API
• Craigslist Scraper — Marketplace Listings & Prices API
• DOL Form 5500 Leads — ERISA Plan Sponsor Prospects API
• China A-Share Screener — 中国股票 Eastmoney API
• FINMA + MAS + SFC Enforcement Records API

27 more in this family on the NexGenData Store page.

⏰ Schedule it

Run on a schedule (0 8 * * 1) to monitor changes over time — an always-on advisory watch.

📊 What you get

Clean JSON output (10 fields):

• package — Package
• ecosystem — Ecosystem
• advisoryId — Advisory Id
• summary — Summary
• severity — Severity
• cveIds — Cve Ids
• published — Published
• modified — Modified

Pricing: $0.030 per advisory (Pay-Per-Event) — about 33 advisorys per $1.

🤖 Use with AI agents

Point Claude, the OpenAI Agents SDK, an n8n flow or any MCP-aware client at it.

Sample agent prompt:

Run Dependency Advisory Monitor on my input and return the structured results.

Agentic payments (x402): Supports agentic payment via x402 — call this actor with USDC, no API key required.

🔗 Related tools — Security audit toolkit

SSL Checker · DMARC Auditor · Domain Security Posture · CVE Monitor · CISA KEV · Chrome Extension Analyzer

---

A NexGenData utility actor.