# GitHub Security Advisories for npm (GHSA NPM Changes)

> GitHub Security Advisories for npm (GHSA NPM Changes) is a paid API for AI agents from oracles-production.up.railway.app, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-15).

Returns reviewed GitHub security advisories for npm packages published since a given timestamp, scored by severity (1-10), with affected package details and source links.

## Facts

- Endpoint: GET https://oracles-production.up.railway.app/v1/ghsa-npm/changes
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/github-security-advisories-for-npm-ghsa-npm-changes-9ce0f80b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ji04m51luPTygTm9ELhFM

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability github-security-advisories-for-npm-ghsa-npm-changes-9ce0f80b
```

Example prompt: Pull all GitHub security advisories for npm packages published since 2025-01-01T00:00:00Z with a severity score of at least 7, limit to 50 results.

## When to prefer this

Use this endpoint when you need to continuously monitor or poll for new npm package security advisories from the GitHub Advisory Database, especially when you need severity-scored results filterable by time window and minimum significance. Prefer this over generic CVE feeds when you specifically care about the npm ecosystem and want GHSA-curated, reviewed advisories with direct source links for verification.

## Known failure modes

- Invalid ISO-8601 timestamp in 'since' parameter returns a 400 error
- 'limit' value outside 1-500 range returns validation error
- 'min_significance' outside 1-10 range returns validation error
- No advisories matching the criteria returns an empty changes array with count 0
- Payment not included or insufficient USDC balance returns 402 Payment Required
- Service downtime or upstream GitHub Advisory Database unavailability returns 503

## How this service works

New security vulnerabilities and CVEs affecting npm packages published since a timestamp (GitHub's reviewed advisory database) — each with its CVE ID, CVSS/severity score, affected package names, and a link. Answers "did a dependency I use get a new CVE or vulnerability I should patch?"

## Output

Returns a JSON object containing a count of matching advisories and an array of change records, each with a title, summary, GHSA entity ID, severity significance score (1-10), detection timestamp, effective date, affected package details, and a direct source URL to the advisory on GitHub.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "limit": {
       "type": "integer",
       "maximum": 500,
       "minimum": 1
      },
      "since": {
       "type": "string",
       "format": "date-time",
       "description": "Only changes detected after this ISO-8601 instant"
      },
      "min_significance": {
       "type": "integer",
       "maximum": 10,
       "minimum": 1,
       "description": "Keep only changes scored at least this"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "count": {
       "type": "integer"
      },
      "source": {
       "type": "string"
      },
      "changes": {
       "type": "array",
       "items": {
        "type": "object",
        "properties": {
         "type": {
          "type": "string"
         },
         "title": {
          "type": "string"
         },
         "detail": {
          "type": "object"
         },
         "summary": {
          "type": "string"
         },
         "entityId": {
          "type": "string"
         },
         "sourceUrl": {
          "type": [
           "string",
           "null"
          ],
          "description": "Primary-source link for verification"
         },
         "detectedAt": {
          "type": "string",
          "format": "date-time"
         },
         "significance": {
          "type": "integer",
          "maximum": 10,
          "minimum": 1
         },
         "effectiveDate": {
          "type": [
           "string",
           "null"
          ]
         }
        }
       }
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/github-security-advisories-for-npm-ghsa-npm-changes-9ce0f80b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from oracles-production.up.railway.app](https://www.zero.xyz/host/oracles-production.up.railway.app/llms.txt)