Menu

Individual skill

deepxiv-fa-osv

0upvotes

Search ~200k open-source package advisories not covered by CVE, mostly malicious-package reports (npm, PyPI …) with behaviours, impersonated packages and IOCs. Use when checking whether a package is malicious or for supply-chain advisories.

skills/deepxiv-fa-osv/SKILL.md

Read pinned source

Source commit 95676a17a732655c73d8b28fd7b0c177485db9e8

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 10, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
849
Repository last updated
Oct 19, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# DeepXiv · OSV (`osv`)

About 200k open-source package security advisories — the part of osv.dev that CVE does not cover (synced daily; exact count in corpus). **Over 90% are malicious-package reports** (MAL-*, overwhelmingly npm); the remaining ~13k are standalone advisories with no CVE id (GHSA / RUSTSEC / PYSEC / GO …). Malicious behaviours (closed set of 13), the legitimate package being impersonated, IOCs (domains / URLs / IPs / filenames, each verified to appear in the advisory text) and one-line summaries are model-extracted. Hybrid vector + lexical search; filters and sorting in Postgres.

Corpus: 199,701 documents.

## Setup

```bash
pip install -U deepxiv-sdk      # deepxiv registers a token on first use
```

With a registered key (https://data.rag.ac.cn/register), `search` and `read` are fair use: 60/min, 5 at once, 5,000/day; on the auto-registered token they spend the deepxiv daily limit at the credits listed below. `ask` draws on the daily ask allowance (resets 00:00 UTC; a site-wide daily total can run out early at peak times), or 3 lifetime trial asks on the auto-registered token. On 429, back off for `Retry-After` seconds. Data goes to stdout; cost, quota and sources go to stderr. Exit 0 ok, 1 API error, 2 usage error. The general CLI guide is the `deepxiv-cli` skill.
Back to top