Workflow page
Open Source Package Risk API
A buyer review page for developer-platform, AppSec, and tooling teams that want a lightweight API or CSV feed for package advisory, license, deprecation, dependency, and version-change records.
GET /v1/packages/watchlist/changes?ecosystem=npm&packages=sample-package,another-package&since=2026-07-01
{
"data": [
{
"ecosystem": "npm",
"packageName": "sample-package",
"version": "1.4.2",
"changeType": "new_advisory",
"advisoryId": "OSV-2026-0001",
"sourceUrl": "https://osv.dev/vulnerability/OSV-2026-0001"
}
],
"meta": { "sampleOnly": true, "workflow": "open-source-package-risk-api" }
}
Likely Buyers
This page is a product preview for comparing likely buyers, source coverage, and first API shapes.
- Developer-tool teams building package watchlist and SBOM features.
- AppSec teams that need source-linked package advisory deltas.
- Platform teams enriching internal dependency dashboards.
Initial Data Scope
The first buyer-ready workflow should keep the source coverage narrow.
- OSV and deps.dev-backed watchlist for one or two ecosystems first.
- Daily cached JSON and CSV exports with package, version, advisory, and source fields.
- No repository upload, proprietary malware detection, reachability scoring, or legal advice.