Send critical NPM CVE alerts from GitHub to Slack via Apify

Quick overview This workflow runs every Monday at 9am to fetch your repository’s package.json from GitHub, scan it for vulnerabilities using the Apify NPM CVE Monitor actor, and send an emergency alert to a Slack channel only when high or critical issues (or suspicious patterns) are detected. How it works 1. Runs every Monday at 9am on a schedule. 2. Fetches the latest package.json file from your GitHub repository using the GitHub Contents API. 3. Sends the package.json content to the Apify NPM CVE Monitor actor to scan for medium-and-above vulnerabilities and suspicious dependency patterns. 4. Retrieves the scan results from the Apify dataset and groups findings into critical, high, medium, and suspicious buckets. 5. Checks whether any critical or high severity vulnerabilities are present and stops if none are found. 6. Formats a detailed Slack message with per-package CVE details and suggested fixes and posts it to the configured Slack channel. Setup 1. Create a GitHub personal access token with read access to repository contents and replace YOURGITHUBORG/YOURREPO and YOURGITHUBTOKEN in the GitHub request URL and Authorization header. 2. Add your Apify API token and replace YOURAPIFYAPITOKEN in both Apify HTTP requests. 3. Configure Slack OAuth2 credentials in n8n and replace YOURSLACKCHANNELID with the target channel ID. 4. Update the repository name placeholder in the Slack message text inside the emergency alert formatting step so alerts reference the correct repo.