NullVoid is a static scanner for malicious code in npm packages and Node.js projects. GitHub data feeds it in three places: live vulnerability lookups during a scan, community signals about a package's source repository, and the training labels for its machine-learning models.

1. Live advisory lookups (GitHub Security Advisories)

For every declared dependency, NullVoid queries the GitHub Advisory Database through the GraphQL API ( https://api.github.com/graphql ). It asks for npm-ecosystem advisories affecting the package, then checks the installed version against each advisory's vulnerableVersionRange so only advisories that actually apply are reported.

Each matching advisory becomes a finding carrying:

the GHSA ID and permalink, plus any CVE identifiers

GitHub's severity (CRITICAL / HIGH / MODERATE / LOW) and CVSS score

CWE classifications

the first patched version, so the report can say what to upgrade to

GHSA is one of several IoC providers, alongside npm advisories, NVD and optionally Snyk.…