CISA's KEV catalogue has no RSS feed, so here is one (and which npm, PyPI and Maven packages are on it)

Описание и применение

CISA KEV каталог не имеет RSS‑ленты и указывает только поставщиков, поэтому автор создал два Atom‑канала и JSON‑файл, связывающий CVE с пакетами npm, PyPI и Maven, а также сканер lockfile и GitHub Action для CI.

Задача

CISA’s KEV catalogue lacks a feed and references vendors instead of package names, making it hard to monitor vulnerable packages in lockfiles.

Результат

Developers can now subscribe to KEV updates via RSS, query vulnerable packages in JSON, and automatically fail CI when a dependency is on the KEV list.

Рабочий процесс

• 1. Build Atom feeds: https://crawatch.dev/kev/all.xml and https://crawatch.dev/kev/feed.xml
• 2. Create JSON join at https://crawatch.dev/kev/packages.json
• 3. Use Cloudflare Worker to hourly fetch new KEV entries and daily re‑read older ones via OSV.dev API
• 4. Provide scan endpoint https://crawatch.dev/scan for lockfiles and GitHub Action that fails on vulnerable dependencies

Доказательства

CISA publishes the catalogue as a JSON file and a CSV file. Fine for scripts, but nothing a feed reader, Slack's RSS app or an RSS-to-email service can subscribe to.

Источник

It names vendors, not packages. An entry says "Vite Vitejs Improper Access Control". Your lockfile says vite 4.5.0. Joining the two means looking every CVE up in an advisory database.

Источник

Every new KEV entry, all vendors: https://crawatch.dev/kev/all.xml (the newest 100, updated within the hour of CISA publishing)

Источник

Only the entries that name an open-source package (npm, PyPI, Maven, Go, Composer, NuGet, RubyGems): https://crawatch.dev/kev/feed.xml

Источник

https://crawatch.dev/kev/packages.json has, for each entry, the CVE, CISA's dates and ransomware flag, the GitHub advisory, and every package it names with the affected range and the fixed versions. CORS is open.

Источник

A Cloudflare Worker does this every hour for new entries and re-reads three older ones a day, so ranges stay current when an advisory gains a new fixed version.

Источник

If you would rather check than read: paste a lockfile at https://crawatch.dev/scan (19 formats, no account), run npx crawatch package-lock.json, or add the GitHub Action, which fails a build when a dependency is on the list.

Источник