check-ghsa.mjs

// This script checks the GitHub Advisory database for advisories affecting specific packages.
// https://github.com/advisories
// API docs: https://docs.github.com/en/rest/security-advisories/repository-advisories

const packages = [
	'puppeteer',
	'puppeteer-core',
	'@puppeteer/browsers',
	'@puppeteer/replay',
	'chrome-devtools',
	'chrome-devtools-mcp',
	'chrome-devtools-frontend',
	'devtools-protocol',
];

async function checkAdvisories() {
	console.log('Checking for advisories…');

	const baseUrl = 'https://api.github.com/advisories';
	const params = new URLSearchParams();
	params.append('ecosystem', 'npm');
	params.append('affects', packages.join(','));

	const url = `${baseUrl}?${params.toString()}`;

	try {
		const response = await fetch(url, {
			headers: {
				Accept: 'application/vnd.github+json',
			},
		});

		if (!response.ok) {
			throw new Error(`HTTP error! Status: ${response.status}`);
		}

		const advisories = await response.json();
		console.log(`Found ${advisories.length} advisories.`);

		for (const advisory of advisories) {
			console.log(`\nAdvisory: ${advisory.summary}`);
			console.log(`  Severity: ${advisory.severity}`);
			console.log(`  URL: ${advisory.html_url}`);
			console.log(`  Published: ${advisory.published_at}`);
			console.log(`  Last updated: ${advisory.updated_at}`);
		}
	} catch (error) {
		console.error('Error checking advisories:', error.message);
	}
}

await checkAdvisories();