npm & PyPI Dependency Risk Report

Buyer: engineering, security, and platform teams that need a small, source-linked queue of package upgrade risks across npm and PyPI portfolios. Input: exact public package names, ecosystems, and installed versions. Output: a report-first portfolio row followed by changed package risk rows, actionable upgrade alerts, and an optional export row.

This actor reads official npm registry metadata, the official PyPI JSON API, and OSV advisories. GitHub repository metadata is optional enrichment only; npm/PyPI/OSV analysis completes without a GitHub token.

Start with a low-cost paid trial

Use this capped input to verify the source and output shape before buying a full report. It disables the report and export events, caps the run at $0.50, and charges only delivered package-risk-row rows at $0.010 each. A zero-row run has zero event charge.

Open the maintained starter input if you prefer a standalone JSON file.

{
  "packages": [
    {
      "name": "lodash",
      "ecosystem": "npm",
      "version": "4.17.20"
    }
  ],
  "includeGitHub": false,
  "initialRunMode": "emit_backfill",
  "generateReport": false,
  "emitRawRows": true,
  "emitUnchanged": false,
  "emitExport": false,
  "maxChargeUsd": 0.5,
  "dryRun": false
}

When the result fits your workflow, enable the full package-portfolio-risk-report output ($9.00 per delivered report) and set a buyer-approved maxChargeUsd.

Input

{
  "packages": [
    { "name": "lodash", "ecosystem": "npm", "version": "4.17.20" },
    { "name": "requests", "ecosystem": "PyPI", "version": "2.31.0" }
  ],
  "dryRun": false,
  "maxChargeUsd": 25
}

Each package should include an exact installed version for meaningful upgrade comparison. repository is optional and is used only when GitHub enrichment is enabled. baselineOnly saves the current snapshot without producing rows. Request controls include requestTimeoutSeconds, rateLimitMs, maxRetries, backoffBaseMs, and maxBackoffMs.

Output

Rows use rowType values package_portfolio_risk_report, package_risk, package_upgrade_risk_alert, and package_risk_export. Every billable row includes billingEventName, a deterministic stableKey, an idempotencyKey, official sources, limitations, and prohibitedInterpretations.

The report row is emitted first when a change is found. A package risk row carries current and latest versions, upgrade kind, risk level, advisory IDs and severities, repository metadata, and source URLs. An alert row carries the reason and a suggested review action. The output also contains deliveryAudit with planned and captured charges, event counts, idempotency keys, maxChargeUsd, delivery status, and state-commit status.

Examples

1. Establish a free baseline

Run once with the portfolio and baselineOnly: true, or with the first live run. The snapshot is saved and the run returns zero dataset rows and zero billable events.

{
  "packages": [
    { "name": "fastify", "ecosystem": "npm", "version": "4.28.1" },
    { "name": "urllib3", "ecosystem": "PyPI", "version": "2.2.2" }
  ],
  "baselineOnly": true,
  "dryRun": false
}

2. Run a change-aware portfolio report

Use the same portfolio on a later run. New registry versions or OSV advisory changes produce the configured report and risk events; an unchanged portfolio produces zero rows and zero charges.

Set initialRunMode to baseline_only for scheduled monitoring. The first successful run saves the official-source snapshot with zero rows and zero charge. Use emit_backfill only when you explicitly want an initial charged report.

{
  "packages": [
    { "name": "fastify", "ecosystem": "npm", "version": "4.28.1" },
    { "name": "urllib3", "ecosystem": "PyPI", "version": "2.2.2" }
  ],
  "generateReport": true,
  "maxChargeUsd": 20,
  "dryRun": false
}

3. Add optional GitHub context and a handoff export

Set includeGitHub: true and provide githubToken only when public repository metadata is useful. Without a token, GitHub is explicitly marked skipped and the required official sources still run. emitExport adds one export event when a change is found.

{
  "packages": [
    { "name": "pydantic", "ecosystem": "PyPI", "version": "2.8.2", "repository": "https://github.com/pydantic/pydantic" }
  ],
  "includeGitHub": true,
  "emitExport": true,
  "maxChargeUsd": 20,
  "dryRun": false
}

Report-first sample

Dry runs make the report-first shape visible without network calls or charges. The advisory below is deliberately labeled illustrative.

[
  {
    "rowType": "package_portfolio_risk_report",
    "billingEventName": "package-portfolio-risk-report",
    "reportFirst": true,
    "changedPackageCount": 1,
    "advisoryCount": 1
  },
  {
    "rowType": "package_risk",
    "billingEventName": "package-risk-row",
    "packageName": "lodash",
    "ecosystem": "npm",
    "currentVersion": "4.17.20",
    "latestVersion": "4.17.21",
    "riskLevel": "high",
    "vulnerabilityCount": 1
  },
  {
    "rowType": "package_upgrade_risk_alert",
    "billingEventName": "package-upgrade-risk-alert",
    "alertReason": "known_vulnerability"
  }
]

Pricing

This actor uses PAY_PER_EVENT pricing. There is no start charge. A complete planned event total must fit maxChargeUsd before delivery begins.

Event	Price	When it is emitted
package-risk-row	$0.01	Each changed package risk row
package-upgrade-risk-alert	$0.25	Each actionable changed package alert
package-portfolio-risk-report	$9.00	One changed portfolio report
package-risk-export	$5.00	One optional changed handoff export

First-run baselines and unchanged runs emit zero default dataset rows and zero billable events. Dry runs also emit no charges. No start or heartbeat event is pushed.

Compliance and operating limits

Use package names supplied by the buyer or an authorized inventory. The actor calls public official endpoints only and records source URLs. It does not fetch private registries, private repositories, credentials, source code, or contact data. GitHub authorization is optional and its token is never written to output.

OSV matches and registry versions are evidence for triage, not a finding that a package is exploitable or that an upgrade is compatible. License fields are reported metadata, not legal advice. Network calls have bounded timeouts, retry only on timeout/rate-limit/server errors, exponential backoff, and a minimum request interval. Incomplete source coverage produces no billable rows and cannot advance state.

State load and save are fail closed. Delivery is idempotency-keyed, preflighted against maxChargeUsd, and written to delivery-audit.json or the Apify audit key. A missing chargedCount or an event charge-limit response stops delivery rather than treating an uncharged row as successful.

No-change behavior

The actor stores a fingerprint of official registry and OSV observations per package. The first successful live run establishes that fingerprint at zero charge. Later runs compare fingerprints; when nothing changed, the output contains zero rows, zero chargedCount, and zero charge. State is not advanced after a source error or delivery failure.

Run the next report

• Inspect npm package metadata with npm Package Dependency Intelligence.
• Inspect Python package metadata with PyPI Package Dependency Intelligence.

See also

• docs/source-compliance.md
• docs/store-competitive-snapshot.md
• docs/integration-guide.md
• docs/sample-output.json
• INPUT_SCHEMA.json