# Dependency Advisory Monitor β€” OSV & GitHub Security (`nexgendata/dependency-advisory-monitor`) Actor Scan npm, PyPI, Maven, Go & more dependencies for known vulnerabilities via OSV.dev and the GitHub Advisory Database. CI/CD-ready, no login. - **URL**: https://apify.com/nexgendata/dependency-advisory-monitor.md - **Developed by:** [NexGenData](https://apify.com/nexgendata) (community) - **Categories:** Developer tools, Business, Automation - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, NaN bookmarks - **User rating**: No ratings yet ## Pricing from $30.00 / 1,000 advisories This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## πŸ“¦ Dependency Advisory Monitor Β· OSV & GitHub Security Scan your dependencies for known vulnerabilities across npm, PyPI, Maven, Go, crates.io and more β€” from the open-source OSV.dev database (which aggregates the GitHub Advisory DB and others). Built for devs and security teams wiring vuln-checks into CI/CD. ### ⚑ What you get | Field | Description | |---|---| | `package` / `ecosystem` | The dependency queried | | `advisoryId` | OSV / GHSA advisory ID | | `severity` | CVSS vector/score where available | | `cveIds` | Cross-referenced CVE IDs | | `summary` | Advisory summary | | `affected` | Introduced/fixed version events | | `references` | Source links | ### 🎯 Use cases 1. CI/CD dependency security gates 2. Security teams auditing a software bill of materials (SBOM) 3. Engineering leads tracking advisories for owned packages 4. Vendor risk / supply-chain monitoring ### πŸš€ Sample inputs ```json { "packages": ["npm:lodash","pypi:django","maven:org.apache.logging.log4j:log4j-core"] } ```` ```json { "packages": ["go:golang.org/x/net"], "maxPerPackage": 10 } ``` ### πŸ“¦ Sample output ```json { "package": "lodash", "ecosystem": "npm", "advisoryId": "GHSA-jf85-cpcp-j695", "severity": "CVSS:3.1/...", "cveIds": ["CVE-2019-10744"], "summary": "Prototype Pollution in lodash", "affected": [{"introduced":"0"},{"fixed":"4.17.12"}] } ``` ### πŸ“Š Sample Output ![Sample output](https://api.apify.com/v2/key-value-stores/8gLgXMBveEI1tTz1z/records/dependency-advisory-monitor-output.png) ### πŸ›  How it works 1. **Source** β€” OSV.dev `/v1/query` (official, no login), aggregating GitHub Advisory DB + ecosystem sources. 2. **Normalize** β€” maps ecosystem aliases (pipβ†’PyPI, cargoβ†’crates.io, …). 3. **Enrich** β€” pulls severity, CVE aliases, and affected version ranges. 4. **Schema** β€” one row per advisory. 5. **Fallback** β€” bad/unknown packages are logged and skipped. ### πŸ”— Related Actors - [Tech Stack Detector](https://apify.com/nexgendata/wappalyzer-replacement?fpr=2ayu9b) - [CVE Vulnerability Monitor](https://apify.com/nexgendata/cve-vulnerability-monitor?fpr=2ayu9b) - [Dev Tools MCP](https://apify.com/nexgendata/developer-tools-mcp-server?fpr=2ayu9b) - [Domain WHOIS Lookup](https://apify.com/nexgendata/domain-whois-lookup?fpr=2ayu9b) ### πŸ’° Pricing Example Pay-per-event: **$0.005 per run + $0.03 per advisory** (`advisory-record`). | Advisories | Cost | |---|---| | 100 | ~$3.00 | | 500 | ~$15.01 | | 2,000 | ~$60.01 | Apify's **$5 free credit** covers ~166 advisories. [Start free β†’](https://apify.com/?fpr=2ayu9b) ### βš–οΈ Legal & data sources Data from OSV.dev (open-source vulnerability database, openly licensed) which aggregates the GitHub Advisory Database and ecosystem advisories. Identified User-Agent; official public API. ### ❓ FAQ **Which ecosystems?** npm, PyPI, Maven, Go, crates.io, RubyGems, NuGet, Packagist, and more. **Do I need an API key?** No. **Maven format?** `maven:groupId:artifactId`. **Version-specific?** Package-level today; version filtering on the roadmap. **Fresh?** Live from OSV at run time. **CVE mapping?** Yes β€” `cveIds`. ### πŸ†˜ Troubleshooting - **0 advisories** β€” the package may have none, or the ecosystem alias is wrong (use npm/pypi/maven/go/...). - **Unknown ecosystem** β€” check spelling; see supported list above. - **Maven returns nothing** β€” use the full `groupId:artifactId`. - **Too many** β€” set `maxPerPackage`. ### 🏷️ About NexGenData Structured public-data tools for analysts, developers, and operators. [thenextgennexus.com](https://thenextgennexus.com/actors-by-workflow/). # Actor input Schema ## `packages` (type: `array`): Each as "ecosystem:name", e.g. npm:lodash, pypi:django, maven:org.apache.logging.log4j:log4j-core, go:golang.org/x/net. ## `maxPerPackage` (type: `integer`): 0 = all. ## Actor input object example ```json { "packages": [ "npm:lodash", "pypi:django" ] } ``` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "packages": [ "npm:lodash", "pypi:django" ], "maxPerPackage": 0 }; // Run the Actor and wait for it to finish const run = await client.actor("nexgendata/dependency-advisory-monitor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`πŸ’Ύ Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // πŸ“š Want to learn more πŸ“–? Go to β†’ https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "packages": [ "npm:lodash", "pypi:django", ], "maxPerPackage": 0, } # Run the Actor and wait for it to finish run = client.actor("nexgendata/dependency-advisory-monitor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("πŸ’Ύ Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # πŸ“š Want to learn more πŸ“–? Go to β†’ https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "packages": [ "npm:lodash", "pypi:django" ], "maxPerPackage": 0 }' | apify call nexgendata/dependency-advisory-monitor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=nexgendata/dependency-advisory-monitor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Dependency Advisory Monitor β€” OSV & GitHub Security", "description": "Scan npm, PyPI, Maven, Go & more dependencies for known vulnerabilities via OSV.dev and the GitHub Advisory Database. CI/CD-ready, no login.", "version": "0.0", "x-build-id": "LfNcjMpG5PRjuYayb" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/nexgendata~dependency-advisory-monitor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-nexgendata-dependency-advisory-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/nexgendata~dependency-advisory-monitor/runs": { "post": { "operationId": "runs-sync-nexgendata-dependency-advisory-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/nexgendata~dependency-advisory-monitor/run-sync": { "post": { "operationId": "run-sync-nexgendata-dependency-advisory-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "packages" ], "properties": { "packages": { "title": "Packages", "type": "array", "description": "Each as \"ecosystem:name\", e.g. npm:lodash, pypi:django, maven:org.apache.logging.log4j:log4j-core, go:golang.org/x/net.", "items": { "type": "string" } }, "maxPerPackage": { "title": "Max advisories per package", "type": "integer", "description": "0 = all." } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```