Pricing
from $5.00 / 1,000 vulnerability founds
NPM & PyPI CVE Monitor
Checks npm and PyPI packages against the OSV vulnerability database and npm registry. Detects CVEs, suspicious maintainer patterns, and supply chain risks. Paste your package.json or requirements.txt. £0.001 per package checked.
Pricing
from $5.00 / 1,000 vulnerability founds
Rating
0.0
(0)
Developer
Actor stats
0
Bookmarked
2
Total users
1
Monthly active users
24 days ago
Last modified
Categories
Share
Check your npm and PyPI packages against the OSV vulnerability database, npm audit, and GitHub Advisory Database in one run. Paste your package.json or requirements.txt. £0.001/package — protect your supply chain for pennies.
Post-Shai-Hulud (Sep 2025): supply chain monitoring is no longer optional.
Features
- OSV database — checks against the Open Source Vulnerabilities database (Google, GitHub, CISA — free, no auth)
- npm registry metadata — detects suspicious maintainer patterns, unusual publish velocity, and ownership transfer signals
- package.json + requirements.txt — parse and check entire dependency trees in one run
- Severity filtering — report only critical, high, medium, or all vulnerabilities
- Remediation paths — suggests upgrade target versions where CVE fixes exist
Inputs
| Field | Default | Description |
|---|---|---|
packageJson | — | Paste package.json content |
requirementsTxt | — | Paste requirements.txt content |
npmPackages | [] | Individual npm package names |
pypiPackages | [] | Individual PyPI package names |
checkSuspiciousPatterns | true | Check npm registry for suspicious maintainer patterns |
severityFilter | medium | Minimum severity to report |
Output fields
Each package record includes: packageName, ecosystem, installedVersion, vulnerabilities[], vulnerabilityCount, highestSeverity, hasSuspiciousPatterns, suspiciousPatternDetails, weeklyDownloads, lastPublishedAt, maintainerCount, isDeprecated, recommendedAction, upgradeTarget.
Suspicious pattern detection
Flags packages with:
-
5 version publishes in 7 days (worm-like velocity)
- Package <30 days old with >10k weekly downloads
- Single maintainer on >100k downloads/week package
Pricing (PPE)
run-started— £0.05 per runpackage-checked— £0.001 per package examinedvulnerability-found— £0.04 per package with CVEssuspicious-pattern-detected— £0.05 per package with suspicious patterns
Related actors
- LLM-Ready Web Scraper — extract security advisory and documentation pages as clean text for AI pipelines
- Website Change Tracker — monitor npm, PyPI and GitHub Advisory Database pages for new security notices
