CISA's KEV catalogue has no RSS feed, so here is one (and which npm, PyPI and Maven packages are on it)

说明与用途

CISA KEV 目录缺少 RSS 订阅且仅列出供应商，作者创建了两个 Atom 订阅、一个 JSON 关联文件，将 CVE 与 npm、PyPI、Maven 包对应，并提供 lockfile 扫描器和 GitHub Action 用于 CI。

问题

CISA’s KEV catalogue lacks a feed and references vendors instead of package names, making it hard to monitor vulnerable packages in lockfiles.

结果

Developers can now subscribe to KEV updates via RSS, query vulnerable packages in JSON, and automatically fail CI when a dependency is on the KEV list.

工作流

• 1. Build Atom feeds: https://crawatch.dev/kev/all.xml and https://crawatch.dev/kev/feed.xml
• 2. Create JSON join at https://crawatch.dev/kev/packages.json
• 3. Use Cloudflare Worker to hourly fetch new KEV entries and daily re‑read older ones via OSV.dev API
• 4. Provide scan endpoint https://crawatch.dev/scan for lockfiles and GitHub Action that fails on vulnerable dependencies

证据

CISA publishes the catalogue as a JSON file and a CSV file. Fine for scripts, but nothing a feed reader, Slack's RSS app or an RSS-to-email service can subscribe to.

来源

It names vendors, not packages. An entry says "Vite Vitejs Improper Access Control". Your lockfile says vite 4.5.0. Joining the two means looking every CVE up in an advisory database.

来源

Every new KEV entry, all vendors: https://crawatch.dev/kev/all.xml (the newest 100, updated within the hour of CISA publishing)

来源

Only the entries that name an open-source package (npm, PyPI, Maven, Go, Composer, NuGet, RubyGems): https://crawatch.dev/kev/feed.xml

来源

https://crawatch.dev/kev/packages.json has, for each entry, the CVE, CISA's dates and ransomware flag, the GitHub advisory, and every package it names with the affected range and the fixed versions. CORS is open.

来源

A Cloudflare Worker does this every hour for new entries and re-reads three older ones a day, so ranges stay current when an advisory gains a new fixed version.

来源

If you would rather check than read: paste a lockfile at https://crawatch.dev/scan (19 formats, no account), run npx crawatch package-lock.json, or add the GitHub Action, which fails a build when a dependency is on the list.

来源