Market catalog

Package Supply Chain Risk Monitor

A proposed public-data API and feed for teams that need open-source package advisories, version metadata, license signals, dependency changes, and source-linked risk flags in automation-friendly JSON or spreadsheet-ready CSV.

Request this feed View current demo Open paid API

GET /v1/packages/risks?ecosystem=npm&package=sample-package&since=2026-07-01

{
  "data": [
    {
      "ecosystem": "npm",
      "packageName": "sample-package",
      "version": "1.4.2",
      "eventType": "new_advisory",
      "advisoryId": "OSV-2026-0001",
      "riskFlag": "vulnerability",
      "source": "OSV"
    }
  ],
  "meta": { "sampleOnly": true, "market": "package-supply-chain" }
}

Buyer Fit

This catalog entry summarizes the buyer fit, sources, and access model for this data product.

Package watchlists for developer-platform and AppSec workflows.
SBOM enrichment and dependency-review queues for internal tools.
Recurring CSV demand from teams that need source-linked public data first.

Public Data Sources

The initial product would normalize public records into stable polling endpoints and exports.

OSV vulnerability API
deps.dev Open Source Insights API
GitHub Security Advisory data
Public package registries

Buyer Workflows

These are the specific self-serve workflows this page is designed to support.

Package advisory watchlist

Poll public advisory and package metadata sources for new risk records affecting packages a team already tracks.

Dependency and license change review

Surface source-linked release, dependency, deprecation, and license changes for spreadsheet or SBOM review queues.

Developer-tool enrichment

Normalize ecosystem, package, version, advisory, license, and source fields for tools that already own policy decisions.

Specific Workflow Tests

These pages focus on specific buyer workflows.

Workflow page Open Source Package Risk API Package advisory and dependency watchlists for developer tools

Access Model

Pricing starts with narrow, low-touch access paths for qualified buyers.

Review the source coverage, sample response, and likely workflow fit.
Request access when the workflow matches a buyer use case.
Production availability depends on source scope, refresh cadence, and compliance boundaries.

Product FAQ

Is this a live package security scanner?

No. This is a product page. It supports demand for public package advisory and dependency-change data before building an API, scanner, or CSV feed.

Would it replace SCA, SBOM, or legal license review?

No. The proposed product would provide source-linked public data and normalized records only. Buyers remain responsible for policy, license, exploitability, and remediation decisions.