N8N NPM CVE Audit Webhook: Apify HTML Report to Gmail & Slack

Automatically audit NPM CVEs from Apify and deliver an HTML report to Gmail (with Slack alerts on failures)

This n8n workflow receives an Apify webhook from the NPM CVE Monitor actor, pulls the run’s dataset, generates an HTML dependency security audit report, and emails it via Gmail. If the dataset fetch fails, it posts a clear Slack message so you’re not left guessing.

What this workflow does

• Receives an HTTP POST webhook from Apify when an NPM CVE Monitor run completes.
• Immediately responds “OK” to Apify to acknowledge the webhook without retries.
• Fetches results from the Apify API, retrieving up to 500 items from the actor’s default dataset.
• Builds an HTML audit report that groups findings into Critical, High, Medium, and Suspicious sections, including summary counts and a status-based email subject.
• Sends the HTML report via Gmail on every run to your configured recipient.
• Handles errors: if the dataset fetch fails, formats an error message and posts it to Slack for visibility.

Use cases

• Security monitoring for SaaS operators who want automated NPM CVE reporting without manually checking dashboards.
• Dependency risk triage: route critical findings to email recipients while notifying teams in Slack when data collection fails.
• Run-at-scale visibility for automation engineers managing periodic security audits through Apify and n8n.

Technical details

• Integrations/Nodes: Webhook, HTTP Request (Apify API), Code (report generation), Gmail, Slack, Sticky Note.
• Setup highlights: create an Apify webhook pointing to the path apify-cve-monitor-report, add YOUR_APIFY_API_TOKEN, set YOUR_PROJECT_NAME, configure the Gmail recipient (replace YOUR_CLIENT_EMAIL@domain.com), and set YOUR_SLACK_CREDENTIAL_ID with your target channel (e.g., #actor-alerts).