A free information service: security advisories for JS, AI and web3 packages, read every hour from public sources and published on this site, in JSON and RSS feeds and through an MCP server.

Using any of them means accepting these terms.

Advisories can arrive late, be incomplete or contain errors. The conditions that make an advisory exploitable are extracted by Claude, a language model, and can be wrong: the linked sources remain the reference.

Patchwire is not a security audit or professional advice. You remain responsible for your systems and for the changes you make to them.

To the extent permitted by law, Patchwire and its publisher are not liable for any damage that results from using, or being unable to use, the site, the feeds or the MCP server.

Advisories from the GitHub Advisory Database are used under the Creative Commons Attribution 4.0 license (CC BY 4.0). Patchwire changes them: it merges duplicates, shortens summaries and adds the conditions extracted by Claude.

Vendor security posts and changelogs belong to their authors: Patchwire quotes short extracts and links to them.

The feeds and the MCP server need no account and no key. Use them in your own tools and agents, including commercial ones; when you republish an advisory, link to its Patchwire page or to its source.

Traffic that degrades the service for others may be limited or blocked.

Names and logos of the projects, platforms and companies listed belong to their owners. They are shown only to identify the software an advisory concerns.

Patchwire is independent: it is not affiliated with or endorsed by Anthropic, GitHub, Vercel or any project it tracks.

These terms can change; the date below changes with them. Last updated 24 Oct 2026.

Questions: hello@monowire.dev.