📦 Dependency Advisory Monitor · OSV & GitHub Security

Scan your dependencies for known vulnerabilities across npm, PyPI, Maven, Go, crates.io and more — from the open-source OSV.dev database (which aggregates the GitHub Advisory DB and others). Built for devs and security teams wiring vuln-checks into CI/CD.

⚡ What you get

Field	Description
package / ecosystem	The dependency queried
advisoryId	OSV / GHSA advisory ID
severity	CVSS vector/score where available
cveIds	Cross-referenced CVE IDs
summary	Advisory summary
affected	Introduced/fixed version events
references	Source links

🎯 Use cases

1. CI/CD dependency security gates
2. Security teams auditing a software bill of materials (SBOM)
3. Engineering leads tracking advisories for owned packages
4. Vendor risk / supply-chain monitoring

🚀 Sample inputs

{ "packages": ["npm:lodash","pypi:django","maven:org.apache.logging.log4j:log4j-core"] }

{ "packages": ["go:golang.org/x/net"], "maxPerPackage": 10 }

📦 Sample output

{ "package": "lodash", "ecosystem": "npm", "advisoryId": "GHSA-jf85-cpcp-j695", "severity": "CVSS:3.1/...", "cveIds": ["CVE-2019-10744"], "summary": "Prototype Pollution in lodash", "affected": [{"introduced":"0"},{"fixed":"4.17.12"}] }

📊 Sample Output

🛠 How it works

1. Source — OSV.dev /v1/query (official, no login), aggregating GitHub Advisory DB + ecosystem sources.
2. Normalize — maps ecosystem aliases (pip→PyPI, cargo→crates.io, …).
3. Enrich — pulls severity, CVE aliases, and affected version ranges.
4. Schema — one row per advisory.
5. Fallback — bad/unknown packages are logged and skipped.

🔗 Related Actors

• Tech Stack Detector
• CVE Vulnerability Monitor
• Dev Tools MCP
• Domain WHOIS Lookup

💰 Pricing Example

Pay-per-event: $0.005 per run + $0.03 per advisory (advisory-record).

Advisories	Cost
100	~$3.00
500	~$15.01
2,000	~$60.01
Apify's $5 free credit covers ~166 advisories. Start free →

⚖️ Legal & data sources

Data from OSV.dev (open-source vulnerability database, openly licensed) which aggregates the GitHub Advisory Database and ecosystem advisories. Identified User-Agent; official public API.

❓ FAQ

Which ecosystems? npm, PyPI, Maven, Go, crates.io, RubyGems, NuGet, Packagist, and more. Do I need an API key? No. Maven format? maven:groupId:artifactId. Version-specific? Package-level today; version filtering on the roadmap. Fresh? Live from OSV at run time. CVE mapping? Yes — cveIds.

🆘 Troubleshooting

• 0 advisories — the package may have none, or the ecosystem alias is wrong (use npm/pypi/maven/go/...).
• Unknown ecosystem — check spelling; see supported list above.
• Maven returns nothing — use the full groupId:artifactId.
• Too many — set maxPerPackage.

🏷️ About NexGenData

Structured public-data tools for analysts, developers, and operators. thenextgennexus.com.