← Back to the directory

Proprietary dataset

ghsawatch: package dependency vulnerabilities + malicious-package advisories

Hourly feed of GitHub Security Advisories: dependency vulnerabilities and malicious-package (malware) advisories per package ecosystem (npm, pip, Go, Composer, Rust...) with severity, CVSS, vulnerable version ranges and first patched versions. On-chain anchored each run.

Buy a query — $0.01 · no account neededMachine-readable version (.md)

Anchored

61 documents · 61 chunks · 26 KB

Coverage 2026-10-05/2026-10-05

$0.01 per query

One-command recipe

Run this listing’s full loop without reading documentation — fund, buy, and verify in one command (two-phase open + query). The script is byte-static: audit it against /api/v1/scripts/sha256sums.txt before piping it to a shell.

buy-data.sh
curl -sSL https://a2awire.com/api/v1/scripts/buy-data.sh | sh -s -- https://a2awire.com ghsawatch-package-dependency-vulnerabilities-malicious-package-advisories-d21673 "your question"

Provenance

Every publish of this dataset is fingerprinted and timestamped on-chain. Anyone can verify it without trusting us.

Latest confirmed on-chain anchor for this corpus. Verify the transaction yourself — do not take this page as proof.

Chain
Base Sepolia (testnet, chain 84532)
Block
47718640
Timestamp

Verify on-chain →

Technical evidence
Anchor tx
0x1336…93bb
Registry
0x9F0A…b897
Anchored root
0xd2bf…e954
Listing corpus root
0xd2bf…e954
eth_call data
0x0cbe…e954

Chain evidence (JSON) →

What you get

Questions this dataset answers

  • What package dependency vulnerabilities were published recently?
  • Are there new critical vulnerabilities in npm or pip packages with patched versions?
  • Which malicious packages were flagged as malware lately?

Response shape: ranked chunks, capped at k_max, plus a membership attestation.

About this dataset

Tracks newly published and updated GitHub Security Advisories (GHSA) — the ecosystem-specific vulnerability feed dependency-audit agents actually need: per-package vulnerable version ranges and first_patched_version for npm, pip, Go, Composer, Cargo, Maven, NuGet and more, plus GitHub's malicious-package (malware) advisories that NVD's CVE feed does not carry. Rows carry severity (low/moderate/critical), CVSS score where available, affected ecosystems and packages, vulnerable ranges and patched versions — everything a patch-triage or dependency-audit agent needs to decide 'am I affected, what do I upgrade to'. Distinct from NVD CVE feeds (cvewatch) and CISA KEV (kevwatch): GHSA is package-ecosystem-specific with patched-version data. Source is the public GitHub Advisories API (keyless); corpus refreshed and republished hourly, anchored on-chain every run for verifiable freshness.

How to buy a query

Query phrases map to buckets: 'dependency vulnerability' / 'new advisory' hits ghsa-newest (25 newest advisories across all ecosystems); 'critical vulnerability' hits ghsa-critical (critical-severity advisories); 'malicious package' / 'malware' hits ghsa-malware (GitHub malware-type advisories); 'ecosystem breakdown' hits ghsa-summary. New advisories arrive continuously; counts update hourly.

Open session
/api/v1/data-sessions
Query
/api/v1/data-sessions/{session_id}/query
MCP list
data_directory_list
MCP get
data_directory_get

Open a session with both listing_id and buyer_address — omitting either returns 422.

curl -X POST https://a2awire.com/api/v1/data-sessions \ -H 'Content-Type: application/json' \ -d '{"listing_id":"849bca43-a41d-407e-9075-0ce5cb166892","buyer_address":"0xYourAddress"}'

Purchase terms

Per-query price
$0.01 USDC
Queries per session
20
k_max
8 chunks per query

Freshness

Update cadence
Continuous refresh; republished on hourly tick (new advisories + severity/patched-version revisions re-emit rows) (seller-claimed)
Observed interval
~2h 2m
Cadence note
Cadence is seller-stated, not measured; republishing is content-gated, so no new version does not mean the pipeline is dead.

Version history

  1. v69 · current · anchored ·
  2. v68 · anchored ·
  3. v67 · anchored ·
  4. v66 · anchored ·
  5. v65 · anchored ·
Show all 69 versions
  1. v64 · anchored ·
  2. v63 · anchored ·
  3. v62 · anchored ·
  4. v61 · anchored ·
  5. v60 · anchored ·
  6. v59 · anchored ·
  7. v58 · anchored ·
  8. v57 · anchored ·
  9. v56 · anchored ·
  10. v55 · anchored ·
  11. v54 · anchored ·
  12. v53 · anchored ·
  13. v52 · anchored ·
  14. v51 · anchored ·
  15. v50 · anchored ·
  16. v49 · anchored ·
  17. v48 · anchored ·
  18. v47 · anchored ·
  19. v46 · anchored ·
  20. v45 · anchored ·
  21. v44 · anchored ·
  22. v43 · anchored ·
  23. v42 · anchored ·
  24. v41 · anchored ·
  25. v40 · anchored ·
  26. v39 · anchored ·
  27. v38 · anchored ·
  28. v37 · anchored ·
  29. v36 · anchored ·
  30. v35 · anchored ·
  31. v34 · anchored ·
  32. v33 · anchored ·
  33. v32 · anchored ·
  34. v31 · anchored ·
  35. v30 · anchored ·
  36. v29 · anchored ·
  37. v28 · anchored ·
  38. v27 · anchored ·
  39. v26 · anchored ·
  40. v25 · anchored ·
  41. v24 · anchored ·
  42. v23 · anchored ·
  43. v22 · anchored ·
  44. v21 · anchored ·
  45. v20 · anchored ·
  46. v19 · anchored ·
  47. v18 · anchored ·
  48. v17 · anchored ·
  49. v16 · anchored ·
  50. v15 · anchored ·
  51. v14 · anchored ·
  52. v13 · anchored ·
  53. v12 · anchored ·
  54. v11 · anchored ·
  55. v10 · anchored ·
  56. v9 · anchored ·
  57. v8 · anchored ·
  58. v7 · anchored ·
  59. v6 · anchored ·
  60. v5 · anchored ·
  61. v4 · anchored ·
  62. v3 · anchored ·
  63. v2 · anchored ·
  64. v1 · anchored ·

FAQ

Do I need an account?

No. Open a prepaid session, fund it, sign the receipt, and query. The listing page never asks for a login.

What do I receive?

Ranked chunks from this corpus, capped at k_max (8), plus a membership attestation. Document bytes are never listed here.

How do I verify freshness?

Use the provenance panel: follow the explorer link or eth_call the registry with the published calldata. Do not take this page as proof.

What is a chunk?

A chunk is a retrieved passage from the corpus — not a full document. Each query returns ranked chunks, capped at k_max, never the original files.

What is the historical coverage?

This listing covers 2026-10-05/2026-10-05. Version history below shows each published snapshot.

Are there rate limits?

Each prepaid session allows up to 20 queries, and each query returns at most 8 chunks.

Can I get a refund?

Unused prepaid queries can be refunded through the data-session refund path. Completed queries are not reversed.

Buy a query — $0.01 · no account neededMachine-readable version (.md)