Explore/Dependency Watch
Ambush / Dependency Watch

Hear about the vulnerabilities Dependabot can't see yet

Open in Ambush
What it does

Dependency Watch follows new security advisories and checks them against the packages and versions in your GitHub repositories. It verifies affected versions with OSV, so you hear about vulnerabilities that apply to your code.

Connect it to your agent to get the affected repository, package and fix in one alert. Or browse the original advisories in Ambush and follow the source stream.

Every advisory, one feed.

Public repos only. Reads root package.json and npm lockfiles.

Try an example

Recent advisories

Template stream

Package Security Advisories

View template

This stream gathers security advisories and reports of compromised open-source packages. Dependency Watch uses this shared feed to watch for new issues.

Dependency Watch connects that feed to your GitHub repositories. Your agent checks the packages and versions you use, verifies affected versions with OSV, and finds a fix. In Ambush, subscribe to the stream or fork it to change what it watches.