<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Supply Chain Threat Intelligence

## OSV (Open Source Vulnerabilities) API

**Base URL:** `https://api.osv.dev/v1/`

### Query by Package URL
```bash
curl -X POST https://api.osv.dev/v1/query \
  -d '{"package":{"purl":"pkg:npm/lodash@4.17.20"}}'
```

### Query by Commit
```bash
curl -X POST https://api.osv.dev/v1/query \
  -d '{"commit":"COMMIT_HASH"}'
```

### Get Vulnerability Details
```bash
curl https://api.osv.dev/v1/vulns/GHSA-xxxx-xxxx-xxxx
```

## GitHub Advisory Database API

**Base URL:** `https://api.github.com/advisories`

### Search Advisories
```bash
curl -H "Authorization: Bearer TOKEN" \
  "https://api.github.com/advisories?ecosystem=npm&severity=critical"
```

## NVD CPE Match API

### Search by CPE
```bash
curl "https://services.nvd.nist.gov/rest/json/cves/2.0?cpeName=cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*" \
  -H "apiKey: KEY"
```

## CycloneDX SBOM Format

```json
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "components": [
    {
      "type": "library",
      "name": "lodash",
      "version": "4.17.20",
      "purl": "pkg:npm/lodash@4.17.20"
    }
  ]
}
```

## Supply Chain Attack Patterns (ATT&CK)

| Technique | ID | Example |
|-----------|----|---------|
| Compromise Dependencies | T1195.001 | event-stream npm package |
| Compromise Supply Chain | T1195.002 | SolarWinds SUNBURST |
| Compromise Hardware | T1195.003 | Hardware implants |
